HTTP/2 200 
server: nginx
date: Wed, 24 Sep 2025 14:29:55 GMT
content-type: text/html; charset=UTF-8
content-security-policy: default-src 'self';style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;font-src 'self' https://fonts.gstatic.com;script-src 'self' 'unsafe-inline' https://js.stripe.com https://code.jquery.com https://www.googletagmanager.com https://www.google-analytics.com https://www.gstatic.com;img-src 'self' data: https: blob:;connect-src 'self' https://api.stripe.com https://api.openai.com https://www.google-analytics.com https://analytics.google.com;frame-src 'self' https://js.stripe.com https://www.youtube.com https://youtube.com https://www.youtube-nocookie.com https://www.google.com https://maps.google.com https://maps.googleapis.com https://www.google.com/maps;child-src 'self' https://js.stripe.com https://www.youtube.com https://youtube.com https://www.youtube-nocookie.com https://www.google.com https://maps.google.com https://maps.googleapis.com https://www.google.com/maps;object-src 'none';block-all-mixed-content;upgrade-insecure-requests;base-uri 'self';form-action 'self';frame-ancestors 'self';script-src-attr 'none'
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
vary: Origin, Accept-Encoding
access-control-allow-credentials: true
accept-ranges: bytes
cache-control: public, max-age=0
last-modified: Tue, 23 Sep 2025 09:17:59 GMT
etag: W/"12733-19975dd937a"
content-encoding: br
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-permitted-cross-domain-policies: master-only
referrer-policy: same-origin
alt-svc: h3=":443"; ma=86400
content-security-policy: default-src 'self' data:; frame-src 'self' https://www.google.com https://www.youtube.com; connect-src 'self' https://api.stripe.com https://api.openai.com https://www.google-analytics.com https://analytics.google.com https://region1.google-analytics.com; script-src 'self' 'unsafe-inline' https://www.google-analytics.com https://analytics.google.com https://www.googletagmanager.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:;