art4wall.lt

accelerometer=(), ambient-light-sensor=(), attribution-reporting=(), autoplay=(), battery=(), bluetooth=(), browsing-topics=(), camera=(), compute-pressure=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), fullscreen=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), identity-credentials-get=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-create=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), speaker-selection=(), storage-access=(), usb=(), web-share=(), window-management=(), xr-spatial-tracking=(), interest-cohort=()

Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.

strict-origin-when-cross-origin

Controls how much referrer information is sent with requests, preventing data leaks to third parties.

max-age=63072000; includeSubDomains; preload

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

nosniff

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

SAMEORIGIN

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.