HTTP/2 200 date: Wed, 21 Jan 2026 04:43:57 GMT server: Apache strict-transport-security: max-age=31536000;includeSubDomains x-content-type-options: nosniff vary: Accept-Encoding content-encoding: gzip content-security-policy: default-src 'self' data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com https://www.gstatic.com https://ajax.googleapis.com https://www.google-analytics.com https://www.googletagmanager.com https://platform.twitter.com https://code.jquery.com https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://static.hotjar.com https://openlayers.org https://cdn.polyfill.io https://unpkg.com https://d1bxh8uas1mnw7.cloudfront.net https://api.altmetric.com https://embed.altmetric.com https://cdn.plu.mx ; connect-src 'self' 'unsafe-inline' https://region1.google-analytics.com https://static.arcgis.com https://youtube.com https://api.plu.mx ; img-src data: * ; font-src 'self' data: https://cdn.plu.mx ; style-src 'self' 'unsafe-inline' https://ajax.googleapis.com https://code.jquery.com https://openlayers.org https://unpkg.com https://cdn-images.mailchimp.com https://cdn.plu.mx ; frame-src 'self' 'unsafe-inline' https://www.google.com https://www.google.co.uk https://www.youtube.com https://youtube.com https://platform.twitter.com https://syndication.twitter.com https://search.oceanbestpractices.org https://open.spotify.com ; frame-ancestors 'self' ; x-xss-protection: 1; mode=block referrer-policy: strict-origin-when-cross-origin permissions-policy: microphone=() content-length: 2486 content-type: text/html; charset=UTF-8