Embeddable on any site

Framing rules

• X-Frame-Optionsabsent

  The page sends no X-Frame-Options.

• frame-ancestorsabsent

  No enforced Content-Security-Policy sets frame-ancestors.

• Set-Cookie × 2warning

  1 of 2 cookies do not go into a cross-site frame (AWSALBTG): a cookie needs SameSite=None; Secure for that. A login or session inside the frame can fail.

• Cross-Origin-Resource-Policyabsent

  Not sent. A cross-origin page with Cross-Origin-Embedder-Policy: require-corp cannot embed it.

HTTP 200 OK
access-control-allow-headers: X-Typeform-Key, Content-Type, Authorization, Typeform-Version, typeform-app, X-Requested-With, anonymousid, X-Namespace
access-control-allow-methods: GET, OPTIONS, POST, PUT, PATCH, DELETE
access-control-expose-headers: Location, X-Request-Id
cache-control: private no-cache no-store max-age=0 must-revalidate
cf-cache-status: DYNAMIC
cf-ray: a579ac16dc2a70f3-CMH
connection: close
content-type: text/html; charset=utf-8
date: Mon, 09 Nov 2026 03:18:48 GMT
pragma: no-cache
server: cloudflare
strict-transport-security: max-age=63072000; includeSubDomains
traceparent: 00-e953ef865f611ebcd4c5e8c5c528149d-c254a720e82a0efb-00
transfer-encoding: chunked
vary: Accept-Encoding
x-cache: HIT
x-cache-lookup: HIT
x-content-type-options: nosniff
x-envoy-upstream-service-time: 24
x-powered-by: 42212485124-13.12.0
set-cookie: AWSALBTG=…; Expires=Mon, 16 Nov 2026 03:18:48 GMT; Path=/
set-cookie: AWSALBTGCORS=…; Expires=Mon, 16 Nov 2026 03:18:48 GMT; Path=/; SameSite=None; Secure

Fetched from our server with a plain browser request. Headers can differ by region, or when you are signed in.