govnl-1.0.x-dev/config/install/seckit.settings.yml

seckit_xss:
  csp:
    checkbox: true
    vendor-prefix:
      x: false
      webkit: false
    report-only: false
    default-src: "'self' 'statistiek.rijksoverheid.nl'"
    script-src: "'self' 'statistiek.rijksoverheid.nl' 'report-sample'"
    object-src: "'none'"
    style-src: "'self'"
    img-src: "'statistiek.rijksoverheid.nl' 'self' data:"
    media-src: "'self'"
    frame-src: "'self'"
    frame-ancestors: ''
    child-src: ''
    font-src: "'self'"
    connect-src: ''
    report-uri: /report-csp-violation
    upgrade-req: false
    policy-uri: ''
  x_xss:
    seckit_x_xss_option_disable: Disabled
    seckit_x_xss_option_0: '0'
    seckit_x_xss_option_1: 1;
    seckit_x_xss_option_1_block: '1; mode=block'
    select: 0
seckit_csrf:
  origin: false
  origin_whitelist: ''
seckit_clickjacking:
  js_css_noscript: false
  noscript_message: 'Sorry, you need to enable JavaScript to visit this website.'
  x_frame: '1'
  x_frame_allow_from: ''
seckit_ssl:
  hsts: true
  hsts_subdomains: true
  hsts_max_age: 31536000
  hsts_preload: false
seckit_ct:
  expect_ct: false
  max_age: 86400
  report_uri: ''
  enforce: false
seckit_fp:
  feature_policy: false
  feature_policy_policy: ''
seckit_various:
  from_origin: false
  from_origin_destination: same
  referrer_policy: false
  referrer_policy_policy: no-referrer-when-downgrade
  disable_autocomplete: false