X-Xss-Protection: 1; mode=block Date: Fri, 26 May 2017 12:22:12 GMT Pragma: no-cache X-Webkit-CSP: default-src 'self' 'unsafe-inline' http: https: data: *.googleapis.com *.gstatic.com *.google.com *.gstatic.com *.googletagmanager.com *.google-analytics.com *.googleadservices.com *.gravatar.com *.facebook.com *.twitter.com *.youtube.com *.w.org *.wordpress.org *.jsdelivr.net; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.google.com *.googleapis.com *.jsdelivr.net; report-uri https://www.koerperkult.ch/cspsettings/; Set-Cookie: wb_8577_session_id=jdupcf5e8uq3gqaen7ftm3vou7; path=/;HttpOnly;Secure Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Content-Security-Policy: default-src 'self' 'unsafe-inline' http: https: data: *.googleapis.com *.gstatic.com *.google.com *.gstatic.com *.googletagmanager.com *.google-analytics.com *.googleadservices.com *.gravatar.com *.facebook.com *.twitter.com *.youtube.com *.w.org *.wordpress.org *.jsdelivr.net; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.googleapis.com *.gstatic.com *.google.com *.gstatic.com *.googletagmanager.com *.google-analytics.com *.googleadservices.com *.jsdelivr.net; report-uri https://www.koerperkult.ch/cspsettings/; Server: Apache/2.4 HTTP/1.1 200 OK X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Strict-Transport-Security: max-age=10886400 Expires: Thu, 19 Nov 1981 08:52:00 GMT Upgrade: h2,h2c X-Content-Type-Options: nosniff Transfer-Encoding: chunked Connection: Upgrade Content-Type: text/html; charset=UTF-8