Content-Security-Policy-Report-Only: default-src *.cisa.gov; script-src *.cisa.gov 'unsafe-inline' 'unsafe-eval' www.googletagmanager.com cse.google.com cdn.jsdelivr.net www.google.com www.youtube.com dap.digitalgov.gov cdnjs.cloudflare.com siteimproveanalytics.com *.adtrafficquality.google gov1.siteintercept.qualtrics.com *.gov1.siteintercept.qualtrics.com clients1.google.com; style-src 'unsafe-inline' *.cisa.gov fonts.googleapis.com www.google.com cdnjs.cloudflare.com; img-src *.cisa.gov data: www.google.com clients1.google.com www.googletagmanager.com *.siteimproveanalytics.io *.adtrafficquality.google gov1.siteintercept.qualtrics.com; frame-src *.cisa.gov *.dhs.gov www.youtube.com *.adtrafficquality.google; font-src *.cisa.gov fonts.gstatic.com; connect-src *.cisa.gov www.google-analytics.com www.googletagmanager.com *.adtrafficquality.google gov1.sr.qualtrics.com gov1.siteintercept.qualtrics.com www.google.com analytics.google.com stats.g.doubleclick.net syndicatedsearch.goog gov1.qualtrics.com; report-uri /report-csp-violation