Amnh.org - Shop.amnh.org

date: Mon, 29 Dec 2025 04:01:01 GMT
content-type: text/html; charset=UTF-8
x-sucuri-id: 21022
strict-transport-security: max-age=31536000; includeSubDomains
referrer-policy: strict-origin-when-cross-origin
vary: Accept-Encoding
content-security-policy: script-src-elem connect.facebook.net www.googletagmanager.com static.klaviyo.com static-tracking.klaviyo.com googleads.g.doubleclick.net www.google.com www.gstatic.com *.cloudfront.net *.googletagmanager.com *.klaviyo.com *.doubleclick.net *.google.com *.gstatic.com www.google-analytics.com rum-static.pingdom.net *.hotjar.io *.hotjar.com *.google-analytics.com applepay.cdn-apple.com maps.googleapis.com *.googleapis.com dev.visualwebsiteoptimizer.com up.pixel.ad tools.luckyorange.com payments.worldpay.com/resources/cse/js/worldpay-cse-1.0.2.min.js *.worldpay.com pay.google.com app.vwo.com *.visualwebsiteoptimizer.com cdn.pushcrew.com insight.adsrvr.org 'self' 'unsafe-inline' 'unsafe-eval'; style-src-elem fonts.googleapis.com use.typekit.net p.typekit.net static.klaviyo.com static-tracking.klaviyo.com cdnjs.cloudflare.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.css *.worldpay.com pay.google.com *.visualwebsiteoptimizer.com cdn.pushcrew.com app.vwo.com insight.adsrvr.org 'self' 'unsafe-inline'; font-src fonts.gstatic.com use.typekit.net *.typekit.net *.gstatic.com *.cloudflare.com *.trustedshops.com *.fontawesome.com maxcdn.bootstrapcdn.com static.klaviyo.com *.worldpay.com *.googleapis.com data: pay.google.com data: 'self' 'unsafe-inline'; form-action geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com *.paypal.com https://plumrocket.com https://secure-test.worldpay.com/shopper/3ds/ddc.html pilot-payflowlink.paypal.com www.paypal.com www.sandbox.paypal.com *.cardinalcommerce.com 3ds-secure.cardcomplete.com www.clicksafe.lloydstsb.com pay.activa-card.com *.wirecard.com acs.sia.eu *.touchtechpayments.com www.securesuite.co.uk rsa3dsauth.com *.monzo.com *.arcot.com *.wlp-acs.com * https://hpp.worldpay.com/app/hpp-iframe/integration/wpg/corporate https://secure.worldpay.com/shopper/3ds/ddc.html https://payments-test.worldpay.com/app/hpp-iframe/integration/wpg/corporate https://payments-live.hpp.apps.eu-west-1-7z55k.dev.msp.worldpay.io/app/hpp-iframe/integration/wpg/corporate https://payments.worldpay.com/app/hpp-iframe/integration/wpg/corporate 'self' 'unsafe-inline'; frame-ancestors www.gstatic.com *.chasepaymentechhostedpay.com *.chasepaymentechhostedpay-var.com *.chase.hostedpaymentservice.net *.chase-var.hostedpaymentservice.net https://pay.google.com/ https://www.google.com/ 'self'; frame-src fast.amc.demdex.net *.adobe.com bid.g.doubleclick.net *.youtube.com *.youtube-nocookie.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com player.vimeo.com https://www.google.com/recaptcha/ *.braintreegateway.com *.paypal.com google.com *.google.com www.google.com youtu.be *.vimeo.com *.addthis.com https://www.googletagmanager.com/ https://plumrocket.com *.chasepaymentechhostedpay.com *.chasepaymentechhostedpay-var.com *.chase.hostedpaymentservice.net *.chase-var.hostedpaymentservice.net https://pay.google.com https://secure-test.worldpay.com *.weltpixel.com www.paypal.com www.sandbox.paypal.com pilot-payflowlink.paypal.com c.paypal.com checkout.paypal.com assets.braintreegateway.com pay.google.com *.cardinalcommerce.com * https://payments-test.worldpay.com/app/hpp-iframe/integration/wpg/corporate https://payments.worldpay.com/app/hpp-iframe/integration/wpg/corporate https://payments-live.hpp.apps.eu-west-1-7z55k.dev.msp.worldpay.io/app/hpp-iframe/integration/wpg/corporate https://hpp.worldpay.com/ *.worldpay.com td.doubleclick.net www.facebook.com *.visualwebsiteoptimizer.com app.vwo.com 'self' 'unsafe-inline'; img-src assets.adobedtm.com amcglobal.sc.omtrdc.net dpm.demdex.net cm.everesttech.net *.adobe.com widgets.magentocommerce.com data: www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net www.google.com bid.g.doubleclick.net analytics.google.com www.googletagmanager.com *.vimeocdn.com i.ytimg.com *.youtube.com p.typekit.net *.paypal.com *.typekit.net *.gstatic.com validator.swagger.io https://static.klaviyo.com https://static-forms.klaviyo.com https://fast.a.klaviyo.com https://static-tracking.klaviyo.com/ https://a.klaviyo.com/ https://telemetrics.klaviyo.com/ *.cloudflare.com https://cdn.klarna.com https://s.ytimg.com *.usercentrics.eu blob: https://www.googleadservices.com/ https://www.google-analytics.com/ https://www.google.com/ flagpedia.net maps.gstatic.com *.ftcdn.net *.behance.net t.paypal.com www.paypal.com www.paypalobjects.com fpdbs.paypal.com fpdbs.sandbox.paypal.com www.sandbox.paypal.com b.stats.paypal.com dub.stats.paypal.com assets.braintreegateway.com c.paypal.com checkout.paypal.com www.facebook.com *.facebook.com dev.visualwebsiteoptimizer.com pixel.sitescout.com attribution.sitescout.com d3k81ch9hvuctc.cloudfront.net *.cloudfront.net *.m2eventnetwork.com m2eventnetwork.com shop.summitov.com shop.sheddaquarium.org shop.denverzoo.org destinationisla.com giftshop.thehenryford.org guggenheimstore.org saamnpgstore.si.edu shop.amnh.org shop.historiccharleston.org shop.mos.org shop.mysticseaport.org shop.nga.gov shop.nhm.org shop.obama.org store.cmaquarium.org store.thealamo.org connect.facebook.net magefan.com cm.magefan.com maps.googleapis.com www.gstatic.com *.googleapis.com pay.google.com *.visualwebsiteoptimizer.com app.vwo.com useruploads.vwo.io cdn.pushcrew.com ad.doubleclick.net insight.adsrvr.org data: 'self' 'unsafe-inline'; script-src assets.adobedtm.com *.adobe.com www.googleadservices.com www.google-analytics.com googleads.g.doubleclick.net analytics.google.com www.googletagmanager.com *.newrelic.com *.nr-data.net geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com *.commerce-payment-services.com s.ytimg.com www.googleapis.com vimeo.com www.vimeo.com *.vimeocdn.com *.youtube.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ amcglobal.sc.omtrdc.net *.magento-ds.com use.typekit.net *.typekit.net google.com *.google.com *.cdn-apple.com www.google.com/recaptcha/ www.gstatic.com/recaptcha/ https://static.klaviyo.com https://static-forms.klaviyo.com https://fast.a.klaviyo.com https://static-tracking.klaviyo.com/ https://a.klaviyo.com/ https://telemetrics.klaviyo.com/ *.cloudflare.com https://www.google.com/recaptcha/api.js *.gstatic.com *.googleadservices.com *.googleapis.com *.trustedshops.com *.usercentrics.eu *.addthis.com *.addthisedge.com *.moatads.com www.paypal.com www.paypalobjects.com https://www.googletagmanager.com/ maps.googleapis.com *.chasepaymentechhostedpay.com *.chasepaymentechhostedpay-var.com *.chase.hostedpaymentservice.net *.chase-var.hostedpaymentservice.net https://pay.google.com/gp/p/js/pay.js https://applepay.cdn-apple.com/jsapi/v1/apple-pay-sdk.js https://d35p4vvdul393k.cloudfront.net/sdk_library/us/stg/ops/pc_gsmpi_web_sdk.js https://d16i99j5zwwv51.cloudfront.net/sdk_library/us/prd/ops/pc_gsmpi_web_sdk.js https://payments.worldpay.com/resources/hpp/integrations/embedded/js/hpp-embedded-integration-library.js www.sandbox.paypal.com t.paypal.com js.braintreegateway.com assets.braintreegateway.com c.paypal.com pay.google.com api.braintreegateway.com api.sandbox.braintreegateway.com client-analytics.braintreegateway.com client-analytics.sandbox.braintreegateway.com *.paypal.com songbirdstag.cardinalcommerce.com https://payments.worldpay.com/resources/cse/js/worldpay-cse-1.0.2.min.js payments.worldpay.com/resources/cse/js/worldpay-cse-1.0.2.min.js connect.facebook.net *.cloudfront.net d16i99j5zwwv51.cloudfront.net applepay.cdn-apple.com static.klaviyo.com static-tracking.klaviyo.com www.google.com www.gstatic.com *.visualwebsiteoptimizer.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.adobe.com fonts.googleapis.com https://static.klaviyo.com *.cloudflare.com *.typekit.net *.trustedshops.com *.usercentrics.eu *.fontawesome.com maxcdn.bootstrapcdn.com *.gstatic.com assets.braintreegateway.com https://fonts.googleapis.com/css cdnjs.cloudflare.com use.typekit.net p.typekit.net static.klaviyo.com static-tracking.klaviyo.com app.vwo.com insight.adsrvr.org 'self' 'unsafe-inline'; object-src 'self' 'unsafe-inline'; media-src *.adobe.com https://www.googleadservices.com/ https://www.google-analytics.com/ 'self' 'unsafe-inline'; manifest-src 'self' 'unsafe-inline'; connect-src dpm.demdex.net amcglobal.sc.omtrdc.net www.google-analytics.com www.googleadservices.com analytics.google.com www.googletagmanager.com *.newrelic.com *.nr-data.net vimeo.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com *.adobe.io performance.typekit.net *.sentry.io *.paypal.com google.com *.google.com https://static.klaviyo.com https://static-forms.klaviyo.com https://fast.a.klaviyo.com https://static-tracking.klaviyo.com/ https://a.klaviyo.com/ https://telemetrics.klaviyo.com/ *.cloudflare.com *.googleapis.com https://stats.g.doubleclick.net/ https://www.google-analytics.com/ www.gstatic.com maps.googleapis.com *.chasepaymentechhostedpay.com *.chasepaymentechhostedpay-var.com *.chase.hostedpaymentservice.net *.chase-var.hostedpaymentservice.net www.sandbox.paypal.com www.paypalobjects.com www.paypal.com pilot-payflowlink.paypal.com api.braintreegateway.com api.sandbox.braintreegateway.com client-analytics.braintreegateway.com client-analytics.sandbox.braintreegateway.com *.braintree-api.com *.cardinalcommerce.com rum-collector-2.pingdom.net settings.luckyorange.net *.pingdom.net *.luckyorange.net *.hotjar.io *.hotjar.com ws.hotjar.com wss://ws.hotjar.com https://www.google.com/pay https://pay.google.com/gp/p/web_manifest.json https://pay.google.com/gp/p/payment_method_manifest.json https://pay.google.com/ https://google.com/pay *.worldpay.com dev.visualwebsiteoptimizer.com settings.luckyorange.com api-preview.luckyorange.com/public-auth wss://in.visitors.live/socket.io *.luckyorange.com wss://realtime.luckyorange.com api-preview.luckyorange.com tools.luckyorange.com socket.io *.gstatic.com *.socket.io https://hpp.worldpay.com/app/hpp/135-0/telemetry https://hpp.worldpay.com/app/hpp/135-0/payment/paypalsmartbutton/continue https://payments.worldpay.com/app/hpp/135-0/telemetry/iframe play.google.com pay.google.com fast.a.klaviyo.com static-forms.klaviyo.com www.facebook.com https://pay.google.com/gp/p/js/pay.js www.gstatic.com/recaptcha/releases/* https://applepay.cdn-apple.com/jsapi/v1/apple-pay-sdk.js *.visualwebsiteoptimizer.com app.vwo.com ad.doubleclick.net capi.goodwaygroup.com insight.adsrvr.org 'self' 'unsafe-inline'; child-src assets.braintreegateway.com c.paypal.com *.paypal.com *.visualwebsiteoptimizer.com app.vwo.com http: https: blob: 'self' 'unsafe-inline'; default-src api.capitaloneshopping.com pay.google.com *.visualwebsiteoptimizer.com app.vwo.com useruploads.vwo.io cdn.pushcrew.com insight.adsrvr.org 'self' 'unsafe-inline' 'unsafe-eval'; base-uri 'self' 'unsafe-inline';
content-security-policy: upgrade-insecure-requests;
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-live-attribute: true
content-encoding: gzip
pragma: no-cache
expires: Sat, 03 Jan 2026 19:03:10 GMT
cache-control: max-age=604800
x-cache: Miss from cloudfront
via: 1.1 4e17b9920844b6a8df812cad8c3506ec.cloudfront.net (CloudFront)
x-amz-cf-pop: LHR50-P1
x-amz-cf-id: DPVPg_19Pp1D1kFQupZwr-OR6PXXVPLtHtZDkkW8GavAAGBRciY2jA==
server: Sucuri/Cloudproxy
x-sucuri-cache: HIT
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000