Content Security Policy: This site (*) has a Report-Only policy without a report URI.

Header always set X-Xss-Protection "1; mode=block"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy strict-origin-when-cross-origin
Header set Content-Security-Policy-Report-Only "style-src *.tawk.to fonts.googleapis.com cdn.jsdelivr.net"
Header set Content-Security-Policy-Report-Only "script-src...