dm.hr

Cache-Control: max-age=3600, must-revalidate, private
Content-Security-Policy: default-src 'self'; font-src data: https://apps.bazaarvoice.com https://assets.dm.de https://composer.apps.nonprod.gcp.dmtech.cloud; script-src 'self' https://*.bazaarvoice.com https://app.usercentrics.eu https://apps.bazaarvoice.com https://assets.dm.de https://composer.apps.nonprod.gcp.dmtech.cloud https://d2pqvatijh75rn.cloudfront.net https://exc.mm.dm.hr https://mpsnare.iesnare.com https://omt.dm.hr https://tags.tiqcdn.com https://web.cmp.usercentrics.eu https://www.dm.hr https://www.google.com https://www.gstatic.com; worker-src 'self' blob:; connect-src 'self' https://*.bazaarvoice.com https://aggregator.service.usercentrics.eu https://api.mapbox.com https://api.usercentrics.eu https://apps.bazaarvoice.com https://assets.dm.de https://browser-intake-datadoghq.eu https://cart-recos.services.dmtech.com https://cdcs.usercentrics.eu https://collect.tealiumiq.com https://consent-api.service.consent.usercentrics.eu https://consent-rt-ret.service.consent.usercentrics.eu https://consents.usercentrics.eu https://content-preview.apps.prod.gcp.dmtech.cloud https://d2pqvatijh75rn.cloudfront.net https://direct-collect.dy-api.eu https://direct.dy-api.eu https://dmpay-gateway.services.dmtech.com https://dy-api.eu https://editorial-content.dm-static.com https://events.mapbox.com https://exc.mm.dm.hr https://frontend-tracking-infra-service.services.dmtech.com https://graphql.usercentrics.eu https://insights.algolia.io https://kuba-prod.services.dmtech.com https://logs.browser-intake-datadoghq.eu https://maut-prod.services.dmtech.com https://maut-rls.nonprod.services.dmtech.com https://mpsnare.iesnare.com https://my-products-api.services.dmtech.com https://omacs.services.dmtech.com https://omc.dm.hr https://predictive-shopping-service.services.dmtech.com https://product-based-recos.services.dmtech.com https://product-search.services.dmtech.com https://product-semantic-search.services.dmtech.com https://rcom-eu.dynamicyield.com https://recos-as-a-service.services.dmtech.com https://region1.google-analytics.com https://retail-media.services.dmtech.com https://rum.browser-intake-datadoghq.eu https://s2s.adjust.com https://signin.dm.hr https://sos-prod.availability.services.dmtech.com https://staedtetour.dm-fb2.de https://stars.services.dmtech.com https://storage.googleapis.com/gift-card-builder-emergency-disabled-bucket/ https://store-data-service.services.dmtech.com https://store-order-service.services.dmtech.com https://v1.api.service.cmp.usercentrics.eu https://www.google-analytics.com https://zoe-shop-proxy-prod.services.dmtech.com https://cartnext.services.dmtech.com https://content.services.dmtech.com https://content-search-service-preview.apps.prod.gcp.dmtech.cloud https://content-search-service.services.dmtech.com https://products.dm.de https://pds-api-prod.apps.prod.gcp.dmtech.cloud https://shopping-list-prod.services.dmtech.com; media-src 'self'; style-src 'self' 'unsafe-inline' https://*.bazaarvoice.com https://api.tiles.mapbox.com https://apps.bazaarvoice.com https://assets.dm.de https://composer.apps.nonprod.gcp.dmtech.cloud; form-action 'self' https://*.bazaarvoice.com https://apps.bazaarvoice.com https://checkout.dm.hr https://giftcard-checkout.dm.de/api/checkout https://signin.dm.hr; img-src 'self' blob: data: https://*.bazaarvoice.com https://app.usercentrics.eu https://apps.bazaarvoice.com https://assets.dm.de https://cdn-eu.dynamicyield.com https://composer.apps.nonprod.gcp.dmtech.cloud https://content-preview.apps.prod.gcp.dmtech.cloud https://d2pqvatijh75rn.cloudfront.net https://editorial-content.dm-static.com https://exc.mm.dm.hr https://i.ytimg.com https://images.podigee-cdn.net https://img.usercentrics.eu https://img.youtube.com/ https://media.dm-static.com https://photos-eu.bazaarvoice.com https://products.dm-static.com https://uct.service.usercentrics.eu https://content.services.dmtech.com; frame-ancestors 'self' https://*.lxprod.ka.de.dm-drogeriemarkt.com https://account.dm.hr https://app.datadoghq.eu https://checkout.dm.hr https://content-preview.apps.prod.gcp.dmtech.cloud https://mobileapp.dm.hr https://studio.dm-drogeriemarkt.com; frame-src 'self' https://*.bazaarvoice.com https://account.dm.hr https://app.usercentrics.eu https://apps.bazaarvoice.com https://assets.dm.de https://cdn.podigee.com https://checkout.dm.hr https://configurator.nuk.de https://gastfamilie.podigee.io https://geburtskanal-dm.podigee.io https://hey-familie.podigee.io https://kinderwunschsprechstunde.podigee.io https://mobileapp.dm.hr https://player.podigee-cdn.net https://sandbox.om.dm.hr https://signin.dm.hr https://web.cmp.usercentrics.eu https://www.google.com https://www.youtube-nocookie.com; base-uri 'self' https://exc.mm.dm.hr; child-src 'self' blob:; manifest-src 'self'; report-to csp-endpoint; report-uri /__csp-reports__; upgrade-insecure-requests;
Content-Security-Policy-Report-Only: default-src 'self'; font-src data: https://apps.bazaarvoice.com https://assets.dm.de https://composer.apps.nonprod.gcp.dmtech.cloud; script-src 'self' https://*.bazaarvoice.com https://app.usercentrics.eu https://apps.bazaarvoice.com https://assets.dm.de https://composer.apps.nonprod.gcp.dmtech.cloud https://d2pqvatijh75rn.cloudfront.net https://exc.mm.dm.hr https://mpsnare.iesnare.com https://omt.dm.hr https://tags.tiqcdn.com https://web.cmp.usercentrics.eu https://www.dm.hr https://www.google.com https://www.gstatic.com; worker-src 'self' blob:; connect-src 'self' https://*.bazaarvoice.com https://aggregator.service.usercentrics.eu https://api.mapbox.com https://api.usercentrics.eu https://apps.bazaarvoice.com https://assets.dm.de https://browser-intake-datadoghq.eu https://cart-recos.services.dmtech.com https://cdcs.usercentrics.eu https://collect.tealiumiq.com https://consent-api.service.consent.usercentrics.eu https://consent-rt-ret.service.consent.usercentrics.eu https://consents.usercentrics.eu https://content-preview.apps.prod.gcp.dmtech.cloud https://d2pqvatijh75rn.cloudfront.net https://direct-collect.dy-api.eu https://direct.dy-api.eu https://dmpay-gateway.services.dmtech.com https://dy-api.eu https://editorial-content.dm-static.com https://events.mapbox.com https://exc.mm.dm.hr https://frontend-tracking-infra-service.services.dmtech.com https://graphql.usercentrics.eu https://insights.algolia.io https://kuba-prod.services.dmtech.com https://logs.browser-intake-datadoghq.eu https://maut-prod.services.dmtech.com https://maut-rls.nonprod.services.dmtech.com https://mpsnare.iesnare.com https://my-products-api.services.dmtech.com https://omacs.services.dmtech.com https://omc.dm.hr https://predictive-shopping-service.services.dmtech.com https://product-based-recos.services.dmtech.com https://product-search.services.dmtech.com https://product-semantic-search.services.dmtech.com https://rcom-eu.dynamicyield.com https://recos-as-a-service.services.dmtech.com https://region1.google-analytics.com https://retail-media.services.dmtech.com https://rum.browser-intake-datadoghq.eu https://s2s.adjust.com https://signin.dm.hr https://sos-prod.availability.services.dmtech.com https://staedtetour.dm-fb2.de https://stars.services.dmtech.com https://storage.googleapis.com/gift-card-builder-emergency-disabled-bucket/ https://store-data-service.services.dmtech.com https://store-order-service.services.dmtech.com https://v1.api.service.cmp.usercentrics.eu https://www.google-analytics.com https://zoe-shop-proxy-prod.services.dmtech.com https://cartnext.services.dmtech.com https://content.services.dmtech.com https://content-search-service-preview.apps.prod.gcp.dmtech.cloud https://content-search-service.services.dmtech.com https://products.dm.de https://pds-api-prod.apps.prod.gcp.dmtech.cloud https://shopping-list-prod.services.dmtech.com; media-src 'self'; style-src 'self' 'unsafe-inline' https://*.bazaarvoice.com https://api.tiles.mapbox.com https://apps.bazaarvoice.com https://assets.dm.de https://composer.apps.nonprod.gcp.dmtech.cloud; form-action 'self' https://*.bazaarvoice.com https://apps.bazaarvoice.com https://checkout.dm.hr https://giftcard-checkout.dm.de/api/checkout https://signin.dm.hr; img-src 'self' blob: data: https://*.bazaarvoice.com https://app.usercentrics.eu https://apps.bazaarvoice.com https://assets.dm.de https://cdn-eu.dynamicyield.com https://composer.apps.nonprod.gcp.dmtech.cloud https://content-preview.apps.prod.gcp.dmtech.cloud https://d2pqvatijh75rn.cloudfront.net https://editorial-content.dm-static.com https://exc.mm.dm.hr https://i.ytimg.com https://images.podigee-cdn.net https://img.usercentrics.eu https://img.youtube.com/ https://media.dm-static.com https://photos-eu.bazaarvoice.com https://products.dm-static.com https://uct.service.usercentrics.eu https://content.services.dmtech.com; frame-ancestors 'self' https://account.dm.hr https://app.datadoghq.eu https://checkout.dm.hr https://content-preview.apps.prod.gcp.dmtech.cloud https://mobileapp.dm.hr https://studio.dm-drogeriemarkt.com; frame-src 'self' https://*.bazaarvoice.com https://account.dm.hr https://app.usercentrics.eu https://apps.bazaarvoice.com https://assets.dm.de https://cdn.podigee.com https://checkout.dm.hr https://configurator.nuk.de https://gastfamilie.podigee.io https://geburtskanal-dm.podigee.io https://hey-familie.podigee.io https://kinderwunschsprechstunde.podigee.io https://mobileapp.dm.hr https://player.podigee-cdn.net https://sandbox.om.dm.hr https://signin.dm.hr https://web.cmp.usercentrics.eu https://www.google.com https://www.youtube-nocookie.com; base-uri 'self' https://exc.mm.dm.hr; child-src 'self' blob:; manifest-src 'self'; report-to csp-endpoint; report-uri /__csp-reports__
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop-endpoint"
Location: https://www.dm.hr/
Referrer-Policy: strict-origin
Reporting-Endpoints: csp-endpoint="/__csp-reports__", coop-endpoint="/__coop-reports__"
Strict-Transport-Security: max-age=31556952; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Vcap-Request-Id: 81d1ea47-ecd4-4b5a-46b2-65e4558cacc3
X-Xss-Protection: 0
Date: Sun, 31 May 2026 08:03:24 GMT
Via: 1.1 google
Transfer-Encoding: chunked
Alt-Svc: clear