Content-Security-Policy: default-src 'self' https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.googleoptimize.com https://*.cookielaw.org https://*.cloud.coveo.com https://*.googletagmanager.com https://*.fundraiseup.com https://*.google-analytics.com https://*.hotjar.com https://*.facebook.net https://*.quantserve.com https://*.adsrvr.org https://*.vimeocdn.com https://*.pixel.ad https://*.pardot.com https://*.optimizely.com https://*.doubleclick.net https://*.googleadservices.com https://*.sascdn.com https://*.id5-sync.com https://*.licdn.com https://*.ads-twitter.com https://*.googlesyndication.com *; style-src 'self' 'unsafe-inline' *; connect-src 'self' 'unsafe-inline' *; font-src 'self' data: *; img-src 'self' data: *; frame-src 'self' *; media-src 'self' blob: data: *