X-Content-Type-Options: nosniff
X-UA-Compatible: IE=Edge,chrome=1
X-WebKit-CSP: default-src 'self'; script-src 'self' data: https://www.gstatic.com ajax.googleapis.com *.googletagmanager.com *.ytimg.com *.google.com *.google-analytics.com *.youtube.com static.doubleclick.net s7.addthis.com m.addthis.com platform.twitter.com connect.facebook.net c.getscenario.com bat.bing.com pixel.convertize.io https://static.hotjar.com https://script.hotjar.com api.salesfeed.com crmv2.salesfeed.com 'unsafe-inline' 'unsafe-eval'; object-src 'self' *.youtube.com *.ytimg.com 'unsafe-inline'; style-src 'self' fonts.googleapis.com *.ytimg.com https://tagmanager.google.com 'unsafe-inline' crmv2.salesfeed.com; img-src 'self' data: https://*.ccv.nl https://ccv.eu https://*.ccv.eu https://www.google.com https://www.google.nl https://www.google-analytics.com https://stats.g.doubleclick.net https://www.facebook.com https://syndication.twitter.com https://www.thuiswinkel.org https://bat.r.msn.com https://bat.bing.com https://app.getscenario.com https://c.getscenario.com https://s3-eu-west-1.amazonaws.com https://rest-production.mollom.com; media-src 'self' *.youtube.com *.ytimg.com 'unsafe-inline'; frame-src 'self' https://e.ccv.nl https://*.ccv.ch www.google.com *.youtube.com *.ytimg.com s7.addthis.com platform.twitter.com https://www.facebook.com staticxx.facebook.com player.vimeo.com https://vars.hotjar.com 'unsafe-inline'; child-src 'self' https://e.ccv.nl https://*.ccv.ch www.google.com *.youtube.com *.ytimg.com s7.addthis.com platform.twitter.com https://www.facebook.com staticxx.facebook.com player.vimeo.com https://vars.hotjar.com 'unsafe-inline'; font-src 'self' fonts.googleapis.com fonts.gstatic.com; connect-src 'self' https://www.google-analytics.com s7.addthis.com m.addthis.com hotjar.com *.hotjar.com *.hotjar.com:* https://postcode-api.apiwise.nl crmv2.salesfeed.com; report-uri /report-csp-violation
X-XSS-Protection: 1; mode=block
X-Content-Security-Policy: default-src 'self'; script-src 'self' data: https://www.gstatic.com ajax.googleapis.com *.googletagmanager.com *.ytimg.com *.google.com *.google-analytics.com *.youtube.com static.doubleclick.net s7.addthis.com m.addthis.com platform.twitter.com connect.facebook.net c.getscenario.com bat.bing.com pixel.convertize.io https://static.hotjar.com https://script.hotjar.com api.salesfeed.com crmv2.salesfeed.com 'unsafe-inline' 'unsafe-eval'; object-src 'self' *.youtube.com *.ytimg.com 'unsafe-inline'; style-src 'self' fonts.googleapis.com *.ytimg.com https://tagmanager.google.com 'unsafe-inline' crmv2.salesfeed.com; img-src 'self' data: https://*.ccv.nl https://ccv.eu https://*.ccv.eu https://www.google.com https://www.google.nl https://www.google-analytics.com https://stats.g.doubleclick.net https://www.facebook.com https://syndication.twitter.com https://www.thuiswinkel.org https://bat.r.msn.com https://bat.bing.com https://app.getscenario.com https://c.getscenario.com https://s3-eu-west-1.amazonaws.com https://rest-production.mollom.com; media-src 'self' *.youtube.com *.ytimg.com 'unsafe-inline'; frame-src 'self' https://e.ccv.nl https://*.ccv.ch www.google.com *.youtube.com *.ytimg.com s7.addthis.com platform.twitter.com https://www.facebook.com staticxx.facebook.com player.vimeo.com https://vars.hotjar.com 'unsafe-inline'; child-src 'self' https://e.ccv.nl https://*.ccv.ch www.google.com *.youtube.com *.ytimg.com s7.addthis.com platform.twitter.com https://www.facebook.com staticxx.facebook.com player.vimeo.com https://vars.hotjar.com 'unsafe-inline'; font-src 'self' fonts.googleapis.com fonts.gstatic.com; connect-src 'self' https://www.google-analytics.com s7.addthis.com m.addthis.com hotjar.com *.hotjar.com *.hotjar.com:* https://postcode-api.apiwise.nl crmv2.salesfeed.com; report-uri /report-csp-violation
X-Drupal-Cache: HIT
Server: Apache
X-Varnish: 1651805688 1651803314
X-XSS-Protection: 1;mode=block
X-Cache-Hits: 5
HTTP/1.1 200 OK
Content-Language: de
Via: 1.1 varnish
Content-Type: text/html; charset=utf-8
X-Frame-Options: SameOrigin
X-Generator: Drupal 7 (http://drupal.org)
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Cache-Control: public, max-age=0
X-Frame-Options: SAMEORIGIN
Age: 1110
Date: Thu, 28 Sep 2017 07:44:22 GMT
Last-Modified: Thu, 28 Sep 2017 07:02:24 GMT
Etag: "1506582144-1"
Connection: close
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'self'; script-src 'self' data: https://www.gstatic.com ajax.googleapis.com *.googletagmanager.com *.ytimg.com *.google.com *.google-analytics.com *.youtube.com static.doubleclick.net s7.addthis.com m.addthis.com platform.twitter.com connect.facebook.net c.getscenario.com bat.bing.com pixel.convertize.io https://static.hotjar.com https://script.hotjar.com api.salesfeed.com crmv2.salesfeed.com 'unsafe-inline' 'unsafe-eval'; object-src 'self' *.youtube.com *.ytimg.com 'unsafe-inline'; style-src 'self' fonts.googleapis.com *.ytimg.com https://tagmanager.google.com 'unsafe-inline' crmv2.salesfeed.com; img-src 'self' data: https://*.ccv.nl https://ccv.eu https://*.ccv.eu https://www.google.com https://www.google.nl https://www.google-analytics.com https://stats.g.doubleclick.net https://www.facebook.com https://syndication.twitter.com https://www.thuiswinkel.org https://bat.r.msn.com https://bat.bing.com https://app.getscenario.com https://c.getscenario.com https://s3-eu-west-1.amazonaws.com https://rest-production.mollom.com; media-src 'self' *.youtube.com *.ytimg.com 'unsafe-inline'; frame-src 'self' https://e.ccv.nl https://*.ccv.ch www.google.com *.youtube.com *.ytimg.com s7.addthis.com platform.twitter.com https://www.facebook.com staticxx.facebook.com player.vimeo.com https://vars.hotjar.com 'unsafe-inline'; child-src 'self' https://e.ccv.nl https://*.ccv.ch www.google.com *.youtube.com *.ytimg.com s7.addthis.com platform.twitter.com https://www.facebook.com staticxx.facebook.com player.vimeo.com https://vars.hotjar.com 'unsafe-inline'; font-src 'self' fonts.googleapis.com fonts.gstatic.com; connect-src 'self' https://www.google-analytics.com s7.addthis.com m.addthis.com hotjar.com *.hotjar.com *.hotjar.com:* https://postcode-api.apiwise.nl crmv2.salesfeed.com; report-uri /report-csp-violation
Vary: Cookie,Accept-Encoding
Link: <https://ccv.ch/de/frontpage>; rel="canonical",<https://ccv.ch/de/frontpage>; rel="shortlink"
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload