Content-Security-Policy: frame-ancestors 'self'; block-all-mixed-content; default-src 'self'; script-src 'self' 'report-sample' 'unsafe-inline' 'unsafe-eval' https://*.cloudfront.net https://googletagmanager.com https://maps.googleapis.com https://maps.google.com https://script.hotjar.com https://static.hotjar.com https://tagmanager.google.com https://www.googletagmanager.com code.jquery.com https://js.recurly.com https://cdnjs.cloudflare.com; style-src 'self' 'report-sample' 'unsafe-inline' *.cloudfront.net fonts.googleapis.com tagmanager.google.com www.googletagmanager.com code.jquery.com https://js.recurly.com; object-src 'none'; frame-src 'self' maps.googleapis.com maps.google.com vars.hotjar.com www.googletagmanager.com *.pandadoc.com https://api.recurly.com; child-src 'self' www.googletagmanager.com; img-src 'self' data: blob: *.gstatic.com *.googleapis.com *.ggpht.com *.cloudfront.net maps.google.com res.cloudinary.com script.hotjar.com www.googletagmanager.com; font-src 'self' data: *.cloudfront.net fonts.googleapis.com fonts.gstatic.com res.cloudinary.com script.hotjar.com; connect-src 'self' *.api.smartystreets.com *.hotjar.com *.hotjar.io fonts.gstatic.com fonts.googleapis.com maps.google.com maps.googleapis.com region1.google-analytics.com res.cloudinary.com www.googletagmanager.com https://api.recurly.com https://*.api.pearlcertification.com https://api.pearlcertification.com; manifest-src 'self'; base-uri 'self'; form-action 'self'; media-src 'self' res.cloudinary.com; prefetch-src 'self'; worker-src 'self';