Embeddable on any site

Framing rules

• X-Frame-Optionsabsent

  The page sends no X-Frame-Options.

• frame-ancestorsabsent

  No enforced Content-Security-Policy sets frame-ancestors.

• Set-Cookie × 1ok

  Every cookie uses SameSite=None; Secure, so Chrome sends it in a cross-site frame. Safari blocks third-party cookies, and Firefox keeps a separate copy for each site that embeds the page. Add Partitioned (CHIPS) to keep them working in more browsers.

• Cross-Origin-Resource-Policyabsent

  Not sent. A cross-origin page with Cross-Origin-Embedder-Policy: require-corp cannot embed it.

HTTP 403 Forbidden
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: a579bb363b993524-CMH
connection: close
content-security-policy: script-src 'report-sample' 'nonce-XphKxeY_qhdSYajhZ6j7-A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /calendar/u/0/cspreport, require-trusted-types-for 'script';report-uri /calendar/u/0/cspreport, require-trusted-types-for 'script';report-uri /calendar/u/0/cspreport
content-type: text/html; charset=utf-8
cross-origin-embedder-policy-report-only: require-corp; report-to="calendar_coop_coep"
cross-origin-opener-policy-report-only: same-origin-allow-popups; report-to="calendar_coop_coep"
date: Mon, 09 Nov 2026 03:29:07 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
origin-trial: AjyTYHf8xEAhAVTh+xijZ3UXTXlMphOHFXjhD3+Actoe+f2FNuWk3attcE3NSlrBekTItGxJqARYCSiIONcWXgYAAABveyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkNyYXNoUmVwb3J0aW5nU3RvcmFnZUFQSSIsImV4cGlyeSI6MTc3NjcyOTYwMCwiaXNTdWJkb21haW4iOnRydWV9
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
pragma: no-cache
report-to: {"group":"calendar_coop_coep","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/calendar"}]}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
transfer-encoding: chunked
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site, accept-encoding
x-content-type-options: nosniff
x-l2-request-path: l2-managed-14
x-xss-protection: 0
set-cookie: NID=…; expires=Tue, 11-May-2027 03:29:07 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none

Fetched from our server with a plain browser request. Headers can differ by region, or when you are signed in.