Hotelcard.de

server: nginx/1.17.3
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
cache-control: no-cache, private
date: Thu, 11 May 2023 05:09:04 GMT
content-security-policy: default-src 'self' https://hotelcard.com/ https://*.hotelcard.com/ https://www.google-analytics.com/ https://firebaseinstallations.googleapis.com/ https://fcmregistrations.googleapis.com/ https://firebase.googleapis.com/ https://stats.g.doubleclick.net/ https://bid.g.doubleclick.net/ https://api.trustyou.com/ https://s7.addthis.com/ https://hotelcard.ch/ https://*.hotelcard.ch/ https://www.awin1.com/ https://the.sciencebehindecommerce.com/ https://www.paypal.com/ https://player.vimeo.com/ https://www.youtube.com/ https://youtu.be/ https://api-public.addthis.com/ https://www.getback.ch/ https://apps.elfsight.com/ https://api.instacloud.io/ https://m.youtube.com/ https://wchat.eu.freshchat.com/ https://500159408622426.eu.webpush.freshchat.com/ https://tagmanager.google.com/ https://unbounce.com/ https://landing.hotelcard.com/ https://ads.google.com/ https://www.hotjar.com/ https://www.facebook.com/ https://m.addthis.com/ https://vars.hotjar.com/ https://in.hotjar.com/ https://ws7.hotjar.com/ http://*.hotjar.com https://*.hotjar.com http://*.hotjar.io https://*.hotjar.io wss://*.hotjar.com https://e-payment.postfinance.ch/ https://epayment.postfinance.ch/ https://maps.googleapis.com/ https://secure.pointspay.com/ https://*.pointspay.com/ https://ion.hotelcard.de/ https://hooks.stripe.com https://*.google-analytics.com https://gtm.adt313.net https://cnv.adt670.com; font-src 'self' https://fonts.gstatic.com/ https://use.fontawesome.com/ https://fonts.gstatic.com/ http://script.hotjar.com https://script.hotjar.com http://*.hotjar.com https://*.hotjar.com http://*.hotjar.io https://*.hotjar.io https://cdnjs.cloudflare.com/; img-src 'self' data: https: https://hotelcard-files.ams3.cdn.digitaloceanspaces.com/ https://hotelcard-files.ams3.digitaloceanspaces.com/ https://maps.gstatic.com/ https://hotelcard-stage-files.fra1.digitaloceanspaces.com/ https://www.facebook.com/ https://www.google.com/ http://www.awin1.com/ http://*.hotjar.com https://*.hotjar.com http://*.hotjar.io https://*.hotjar.io https://script.hotjar.com http://script.hotjar.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://use.fontawesome.com/ https://www.gstatic.com/ https://maps.googleapis.com/ https://www.googletagmanager.com/ https://s3.amazonaws.com/ http://s3.amazonaws.com/ https://www.google-analytics.com/ https://www.googleadservices.com/ http://www.googleadservices.com/ https://connect.facebook.net/ https://googleads.g.doubleclick.net/ https://cdnjs.cloudflare.com/ https://cdn.jsdelivr.net/ https://s7.addthis.com/ https://z.moatads.com/ https://v1.addthisedge.com/ https://m.addthis.com/ https://hotelcard.us12.list-manage.com/ https://www.dwin1.com/ https://code.jquery.com/ https://maxcdn.bootstrapcdn.com/ https://static.profity.ch/ https://www.getback.ch/ https://www.awin1.com/ https://the.sciencebehindecommerce.com/ https://www.google.com/ https://static.getback.ch/ https://apps.elfsight.com/ https://static.elfsight.com/ https://wchat.eu.freshchat.com/ https://assetscdn-wchat.eu.freshchat.com/ https://snap.licdn.com/ http://static.hotjar.com https://static.hotjar.com/ https://script.hotjar.com/ http://www.awin1.com/ https://ws7.hotjar.com/ http://*.hotjar.com https://*.hotjar.com http://*.hotjar.io https://*.hotjar.io http://*.addthis.com/ https://ion.hotelcard.de/ https://*.hotelcard.de/ https://gtm.adt313.net; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/ https://use.fontawesome.com/ https://cdnjs.cloudflare.com/ https://maxcdn.bootstrapcdn.com/ https://www.getback.ch/ https://static.getback.ch/ https://wchat.eu.freshchat.com/
permissions-policy: accelerometer=(self), autoplay=(self), camera=(self), cross-origin-isolated=(self), document-domain=*, encrypted-media=(self), fullscreen=(self), geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), midi=(self), payment=(self), picture-in-picture=*, publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=*, usb=(self), xr-spatial-tracking=(self)
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-xss-protection: 1; mode=block
referrer-policy: no-referrer
set-cookie: XSRF-TOKEN=eyJpdiI6InlzZDdUU2YxSVhqTXIxbEc4SDU1aFE9PSIsInZhbHVlIjoibWRnam1VTGNkckR2dkpoTHpoSDdROTRxZHVDTitTV282Rk04RDBuQWRzbkZvTVphT28xMjRzMzZ6WkZZVFptUUtubUFEUG0xTlFVZUFXRlcwV2NzVU1aL2RKbnA2QzgyVGRHMGU0Y0xBK1BhZnZvblJ3TmhPY2JZaDdjZU1QU0kiLCJtYWMiOiJkMDYyZmYzMjE0YTJkODVjYjMwNzUyZGFhZjFkZWJmMGRiZjI3MzNmZTNmYzNjNmVhNWU0NWRjZjliZmI2MjgzIiwidGFnIjoiIn0%3D; expires=Thu, 11-May-2023 22:45:04 GMT; Max-Age=63360; path=/; samesite=lax
set-cookie: hotelcard_session=eyJpdiI6IkdxMEFWbUtlQ3Irc05oNDVBanJ2RkE9PSIsInZhbHVlIjoiWlM1NjRMa2ltcFFRa3VraDB3TmVORmU0VXYveFBIaXYrMkhFbnM2UlRmVzZmdWlxM3lDUUJ6UEZCcnY3UFBWYVJIWEVjSWVEYS9oVllzYjVxZXBSUFdwWHdzZ1JRTHlOZWpINnhnWTVDd09wYW9DVU5GTG5UTVRsRjBJQjB6VjAiLCJtYWMiOiJlMjA5MTQ1MWY4NWZlMzlkNGY5MzcxZmNkMDQ2ODAxZTdhMGUwZWViNDhlNTkzNmY4OWNiMmRhZTQzM2RhYzc3IiwidGFnIjoiIn0%3D; expires=Thu, 11-May-2023 22:45:04 GMT; Max-Age=63360; path=/; httponly; samesite=lax
set-cookie: locale=de; expires=Thu, 08-Jun-2023 05:09:03 GMT; Max-Age=2419199; path=/; secure; httponly; samesite=lax
set-cookie: currency=eyJpdiI6IktJVTJXdVN4b1Mwb0lTa2ZCMEdaY1E9PSIsInZhbHVlIjoiV0lvYzRTTDlTK015Q1hKTklMcTBicHV2NG5CampVczdjamxOZSt1a3hya2s4SlIyUXVHSUVlbXdqZlZpTm90NSIsIm1hYyI6IjIxZDNkMGI3NDNiN2JmOWU3YmVkNjNkYTYzNjdiNjQ2YmQzNGJmMTEzMzlhNWY3NzMxZDI3MzdkNjNkM2RmZWEiLCJ0YWciOiIifQ%3D%3D; expires=Thu, 08-Jun-2023 05:09:03 GMT; Max-Age=2419199; path=/; httponly; samesite=lax
content-security-policy: frame-ancestors https://admin.hotelcard.com 'self';
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-encoding: gzip