roneran.ee

accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=*, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=*, picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), xr-spatial-tracking=(), gamepad=(), serial=(), accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(self), encrypted-media=(), fullscreen=*, geolocation=(self), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=*, picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), xr-spatial-tracking=(), gamepad=(), serial=()

Restricts which browser features (camera, microphone, geolocation) the page can use, limiting attack surface.

strict-origin-when-cross-origin, strict-origin-when-cross-origin

Controls how much referrer information is sent with requests, preventing data leaks to third parties.

max-age=31536000, max-age=63072000

Forces browsers to use HTTPS for all future requests, preventing man-in-the-middle attacks and SSL stripping.

nosniff, nosniff

Prevents browsers from MIME-sniffing responses away from the declared Content-Type, blocking drive-by downloads.

SAMEORIGIN, SAMEORIGIN

Prevents the page from being embedded in iframes, protecting against clickjacking attacks.

1; mode=block, 1; mode=block

Legacy XSS filter for older browsers. Modern browsers use CSP instead. Set to "0" to avoid false positives.