dfds.ee

accelerometer=(), autoplay=(self), camera=(), cross-origin-isolated=(self), display-capture=(self), encrypted-media=(self), fullscreen=(self), geolocation=(self), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(self), picture-in-picture=(self "https://youtu.be" "https://youtube.com" "https://*.youtube.com"), publickey-credentials-get=(self), screen-wake-lock=(), sync-xhr=(self), usb=(), xr-spatial-tracking=(self), clipboard-read=(self), clipboard-write=(self), gamepad=(), hid=(self), idle-detection=(self), interest-cohort=(self), serial=(self)

Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.

no-referrer-when-downgrade

Controls how much referrer information is sent with requests, preventing data leaks to third parties.

max-age=63072000; includeSubDomains; preload

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

nosniff

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

deny

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.

1; mode=block

Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.