Strict-Transport-Security

max-age=31536000; includeSubDomains; preload

Content-Security-Policy

report-uri /public/php/csp.php; frame-ancestors 'self' ; default-src 'self' 'unsafe-eval' 'unsafe-inline' blob: data: *.amazonaws.com *.geico.com *.cloud.geico.net *.google.com *.googleapis.com *.gstatic.com *.omtrdc.net *.qualaroo.com *.ringcentral.com *.youtube.com https://*.amazon-adsystem.com https://*.bing.com https://*.branch.io https://*.clarity.ms https://*.cookielaw.org https://*.demdex.net https://*.doubleclick.net https://*.evergage.com https://*.facebook.com https://*.force.com https://*.google-analytics.com https://*.instagram.com https://*.onetrust.com https://*.qualtrics.com https://*.quantummetric.com https://*.radar.com https://*.radar.io https://*.salesforce.com https://*.salesforceliveagent.com https://*.salesforce-sites.com https://*.twitter.com https://*.typekit.net https://agtchtui-api-dv.geico.net https://agtchtui-api-in.geico.net https://agtchtui-api-ut.geico.net https://agtchtui-api-ut.geico.com https://agtchtui-api-lt1.geico.net https://agtchtui-api-lt8.geico.net https://agtchtui-api-ft.geico.net https://agtchtui-api-pd.geico.com https://agtchtui-api-pd1.geico.com https://agtchtui-api-pd8.geico.com https://api.statsig.com https://api.statsigcdn.com https://assets.bugcrowdusercontent.com https://assetsconfigcdn.org https://app.link https://beyondwickedmapping.org https://bugcrowd.com https://cdn.ampproject.org https://cdn.evgnet.com https://cdn.jsdelivr.net https://cloudflare-dns.com https://cm.everesttech.net https://connect.facebook.net https://ct.pinterest.com https://events.statsigapi.net https://featureassets.org https://featuregates.org https://gateway.zscalerthree.net https://geicoinsurance.my.site.com https://geicoinsurance--hotfix.sandbox.my.site.com https://geicoinsurance--botsdev.sandbox.my.site.com https://geicoinsurance--perftest.sandbox.my.site.com https://geicoinsurance--sit.sandbox.my.site.com https://geicoinsurance--uat2.sandbox.my.site.com https://i.ytimg.com https://insight.adsrvr.org https://maxcdn.bootstrapcdn.com https://prodregistryv2.org https://rts.persado.com https://s.w.org https://*.sc-static.net https://sealserver.trustwave.com https://static.cdn-apple.com https://statsigapi.net https://*.snapchat.com https://www.googleadservices.com https://www.googletagmanager.com https://www.paypalobjects.com https://*.tapad.com https://*.linkedin.com ;

X-Frame-Options

sameorigin

X-Content-Type-Options

nosniff

Referrer-Policy

Set a Referrer-Policy header to control how much referrer information is shared

Permissions-Policy

Add a Permissions-Policy header to restrict browser features like camera, microphone, and geolocation