Embeddable on any site

Framing rules

• X-Frame-Optionsabsent

  The page sends no X-Frame-Options.

• frame-ancestorsabsent

  No enforced Content-Security-Policy sets frame-ancestors.

• Set-Cookie × 2warning

  1 of 2 cookies do not go into a cross-site frame (__Secure-cal_acquisition_v1): a cookie needs SameSite=None; Secure for that. A login or session inside the frame can fail.

• Cross-Origin-Resource-Policyabsent

  Not sent. A cross-origin page with Cross-Origin-Embedder-Policy: require-corp cannot embed it.

HTTP 200 OK
age: 0
cache-control: private, no-cache, no-store, max-age=0, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: a579bb2a39c23524-CMH
connection: close
content-type: text/html; charset=utf-8
date: Mon, 09 Nov 2026 03:29:05 GMT
link: </.well-known/api-catalog>; rel="api-catalog", <https://cal.com/docs/api-reference/v2/openapi.json>; rel="service-desc"; type="application/json", <https://cal.com/docs/api-reference/v2/introduction>; rel="service-doc"; type="text/html", </_next/static/media/83afe278b6a6bb3c-s.p.45535valc9rzk.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </_next/static/media/CalSansVF-s.p.051r2yy2270w-.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </_next/static/chunks/0jrf661upfaxz.css>; rel=preload; as="style", </_next/static/chunks/3rm4si_42ct3p.css>; rel=preload; as="style", </_next/static/chunks/1ks5jpwez5bwl.css>; rel=preload; as="style", </_next/static/chunks/3_uj94h31sr8x.css>; rel=preload; as="style", </_next/static/chunks/29d2nrz6qbbi_.css>; rel=preload; as="style"
permissions-policy: geolocation=(self), usb=(), serial=(), bluetooth=(), hid=(), midi=(), xr-spatial-tracking=(), idle-detection=(), local-fonts=(), window-management=()
referrer-policy: no-referrer-when-downgrade
server: cloudflare
strict-transport-security: max-age=63072000
transfer-encoding: chunked
vary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, accept-encoding
x-content-type-options: nosniff
x-matched-path: /[user]/[type]
x-nextjs-rewritten-path: /rick/get-rick-rolled
x-powered-by: Next.js
x-vercel-cache: MISS
x-vercel-id: cle1:cle1:cle1::cle1::hshgs-1794194945657-85717d2e4baa
set-cookie: __Secure-cal_acquisition_v1=…; Path=/; Expires=Sun, 07 Feb 2027 03:29:05 GMT; Max-Age=7776000; Domain=.cal.com; Secure; HttpOnly; SameSite=lax
set-cookie: __cf_bm=…; HttpOnly; SameSite=None; Partitioned; Secure; Path=/; Domain=cal.com; Expires=Mon, 09 Nov 2026 03:59:05 GMT

Fetched from our server with a plain browser request. Headers can differ by region, or when you are signed in.