Content-Security-Policy

zalando.com sends an enforcing CSP. It is allowlist-based.

frame-ancestors 'self' https://content.solutions.zalando.com https://zdirect.zalando.com https://zdirect-portal-staging.merchant-center.zalan.do https://zdirect-portal-dev.merchant-center-test.zalan.do

Directive	Sources
frame-ancestors	'self' https://content.solutions.zalando.com https://zdirect.zalando.com https://zdirect-portal-staging.merchant-center.zalan.do https://zdirect-portal-dev.merchant-center-test.zalan.do

Headers sent

Header	Value
strict-transport-security	max-age=157680000
x-frame-options	sameorigin
server	rendering-engine/gender-split-stackset/main-5592

Critical findings

Re-scan live

This is a snapshot from 2026-08-04. Check it now:

Scan