HTTP/1.1 200 OK
Date: Fri, 09 Jul 2021 14:29:59 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx/1.19.2
Vary: Accept-Encoding
Set-Cookie: PHPSESSID=6sdqv6h6ddeepts6n24obgdb9k; expires=Tue, 07-Sep-2021 14:29:59 GMT; Max-Age=5184000; path=/; domain=www.little-big-change.com; secure; HttpOnly
Set-Cookie: X-Magento-Vary=101460abd5236ef32bf03e3ad4df62d9af0490ff; expires=Tue, 07-Sep-2021 14:29:59 GMT; Max-Age=5184000; path=/; secure; HttpOnly; SameSite=Lax
Pragma: no-cache
Cache-Control: max-age=0, must-revalidate, no-cache, no-store
Expires: Thu, 09 Jul 2020 09:47:03 GMT
Content-Security-Policy-Report-Only: script-src-elem *.perfmaker.net *.privacy-center.org *.ontdf.io geoip-js.com 'self' data: 'unsafe-inline' data: *.newrelic.com *.nr-data.net *.googletagmanager.com *.google.com *.sk.ht *.googleoptimize.com *.hotjar.com *.google-analytics.com *.pinimg.com *.facebook.net *.bing.com *.logbor.com *.little-big-change.com *.teester.com sc-static.net *.gstatic.com *.teads.tv *.yimg.com *.hunkal.com *.quantcount.com *.googleadservices.com *.yahoo.com *.quantserve.com *.doubleclick.net *.zdassets.com *.stripe.com; font-src *.fontawesome.com 'self' 'unsafe-inline'; form-action secure.authorize.net test.authorize.net *.snapchat.com *.facebook.com *.ontdf.io 'self' 'unsafe-inline'; frame-ancestors 'self' 'unsafe-inline'; frame-src www.paypal.com www.sandbox.paypal.com secure.authorize.net test.authorize.net https://www.googletagmanager.com/ js.stripe.com m.stripe.com x.klarnacdn.net klarna.com *.privacy-center.org cl.avis-verifies.com www.googletagmanager.com *.doubleclick.net tr.snapchat.com vars.hotjar.com *.google.com *.perfmaker.net *.ad-srv.net *.amazon-adsystem.com *.facebook.com *.ontdf.io 'self' 'unsafe-inline'; img-src widgets.magentocommerce.com www.paypalobjects.com t.paypal.com *.ftcdn.net *.behance.net data: *.vimeocdn.com www.paypal.com fpdbs.paypal.com fpdbs.sandbox.paypal.com www.googleadservices.com www.google-analytics.com s.ytimg.com http://www.googleadservices.com/ http://www.google-analytics.com/ https://www.googleadservices.com/ https://www.google-analytics.com/ https://www.google.com/ *.privacy-center.org bat.bing.com tk.little-big-change.com *.adsrvr.org sk.ht *.google.com *.google.fr *.google.be ct.pinterest.com www.facebook.com binel.hunkal.com www.little-big-change.com maps.googleapis.com maps.gstatic.com *.teads.tv *.cloud-media.fr *.invibes.com *.adnxs.com *.avads.net *.audiencemanager.de *.b26net.com *.videostep.com *.avis-verifies.com *.quantcount.com *.rubiconproject.com *.ontdf.io 'self' 'unsafe-inline'; script-src assets.adobedtm.com www.paypalobjects.com js.braintreegateway.com www.paypal.com s.ytimg.com video.google.com vimeo.com www.vimeo.com www.sandbox.paypal.com t.paypal.com www.googleadservices.com www.google-analytics.com www.youtube.com secure.authorize.net test.authorize.net http://www.googletagmanager.com/ https://www.googletagmanager.com/ *.avada.io js.stripe.com m.stripe.com x.klarnacdn.net klarna.com *.privacy-center.org www.googletagmanager.com bat.bing.com *.perfmaker.net www.googleoptimize.com script.hotjar.com static.hotjar.com s.pinimg.com connect.facebook.net tk.little-big-change.com sc-static.net u.logbor.com sdk.teester.com events.sk.ht googleads.g.doubleclick.net p.teads.tv binel.hunkal.com static.zdassets.com maps.googleapis.com maps.gstatic.com *.google.fr *.opthb.com *.r66net.com *.uzerly.net *.publicidees.com *.adnxs.com *.amazon-adsystem.com *.yahoo.com *.apicit.net apicit.net *.clickintext.net *.videostep.com *.newrelic.com *.avis-verifies.com *.yimg.com *.invibes.com geoip-js.com *.google.com *.gstatic.com *.sddan.com *.consensu.org *.quantserve.com *.quantcount.com *.ontdf.io *.stripe.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src getfirebug.com *.fontawesome.com *.perfmaker.net *.ontdf.io 'self' 'unsafe-inline'; object-src 'self' 'unsafe-inline'; media-src http://www.googleadservices.com/ http://www.google-analytics.com/ https://www.googleadservices.com/ https://www.google-analytics.com/ *.zdassets.com *.ontdf.io 'self' 'unsafe-inline'; manifest-src 'self' 'unsafe-inline'; connect-src http://stats.g.doubleclick.net/ https://stats.g.doubleclick.net/ http://www.google-analytics.com/ https://www.google-analytics.com/ js.stripe.com m.stripe.com x.klarnacdn.net klarna.com *.privacy-center.org www.google-analytics.com sk.ht stats.g.doubleclick.net ct.pinterest.com in.hotjar.com ekr.zdassets.com littlebigchange.zendesk.com tr.snapchat.com *.perfmaker.net *.nr-data.net geoip-js.com *.yimg.com *.zendesk.com *.zopim.com wss://*.zopim.com *.ontdf.io *.stripe.com 'self' 'unsafe-inline'; child-src http: https: blob: 'self' 'unsafe-inline'; default-src 'self' 'unsafe-inline' 'unsafe-eval'; base-uri 'self' 'unsafe-inline';
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN