Content-Security-Policy: default-src 'self'; connect-src *; font-src 'self' data: https://fonts.gstatic.com; img-src 'self' blob: data: https://*.hostserver.de/ https://www.w3.org/ https://www.hosttest.de/images/ https://s.w.org/ https://ps.w.org/ https://www.gstatic.com/images/branding/product/2x/translate_24dp.png; script-src 'self' 'unsafe-eval' 'unsafe-inline' data: https://cdn.jsdelivr.net/npm/ https://platform.twitter.com/widgets/widgets.js https://www9.hostserver.de/piwik/piwik.js https://www.google.com/recaptcha/api.js https://www.gstatic.com/recaptcha/releases/ https://ajax.googleapis.com/ajax/libs/webfont/; style-src 'self' data: 'unsafe-inline' https://fonts.googleapis.com/; object-src 'self'; base-uri 'self'; frame-src 'self' https://www9.hostserver.de/ https://www.google.com/recaptcha/; worker-src https://www.google.com/recaptcha/; report-uri /csp/report.php