Embeddable on some sites only

Framing rules

• X-Frame-Optionsabsent

  The page sends no X-Frame-Options.

• frame-ancestors 'self' https://adgen-dev.spotify.com/account/*/ad/*/details https://adgen-dev.spotify.com/preview/* https://local.spotify.net/account/*/ad/*/details https://local.spotify.net/preview/* https://app.smartly.io/*some sites

  frame-ancestors limits framing to the listed sources.

• Set-Cookie × 5warning

  3 of 5 cookies do not go into a cross-site frame (sp_t, sp_new, sp_landing): a cookie needs SameSite=None; Secure for that. A login or session inside the frame can fail.

• Cross-Origin-Resource-Policyabsent

  Not sent. A cross-origin page with Cross-Origin-Embedder-Policy: require-corp cannot embed it.

HTTP 200 OK
cf-cache-status: DYNAMIC
cf-ray: a579bb543ecdfa14-CMH
connection: close
content-security-policy: script-src 'self' 'unsafe-eval' blob: open.spotifycdn.com open-review.spotifycdn.com quicksilver.scdn.co www.google-analytics.com www.googletagmanager.com static.ads-twitter.com analytics.twitter.com s.pinimg.com sc-static.net https://www.google.com/recaptcha/ cdn.ravenjs.com connect.facebook.net www.gstatic.com sb.scorecardresearch.com pixel-static.spotify.com cdn.cookielaw.org geolocation.onetrust.com www.fastly-insights.com static.hotjar.com script.hotjar.com https://www.googleadservices.com/pagead/conversion_async.js https://www.googleadservices.com/pagead/conversion/ https://analytics.tiktok.com/i18n/pixel/sdk.js https://analytics.tiktok.com/i18n/pixel/identify.js https://analytics.tiktok.com/i18n/pixel/config.js https://www.redditstatic.com/ads/pixel.js https://t.contentsquare.net/uxa/22f14577e19f3.js https://get.microsoft.com/badge/ms-store-badge.bundled.js https://cdn.us.heap-api.com https://heapanalytics.com 'sha256-WfsTi7oVogdF9vq5d14s2birjvCglqWF842fyHhzoNw=' 'sha256-KRzjHxCdT8icNaDOqPBdY0AlKiIh5F8r4bnbe1PQwss=' 'sha256-Z5wh7XXSBR1+mTxLSPFhywCZJt77+uP1GikAgPIsu2s=' 'sha256-o2wzIImHJ4+WWE5DCTR+myWU0UNml0+wwpDXRo++vII='; frame-ancestors 'self' https://adgen-dev.spotify.com/account/*/ad/*/details https://adgen-dev.spotify.com/preview/* https://local.spotify.net/account/*/ad/*/details https://local.spotify.net/preview/* https://app.smartly.io/*;
content-type: text/html; charset=utf-8
date: Mon, 09 Nov 2026 03:29:12 GMT
server: cloudflare
strict-transport-security: max-age=31536000
transfer-encoding: chunked
vary: Accept-Encoding
via: HTTP/1.1 fringe, HTTP/2 edgeproxy, 1.1 google, 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-content-type-options: nosniff
x-envoy-upstream-service-time: 20
x-served-by: cache-cmh1290057-CMH
x-spotify-open-index: true
x-timer: S1794194952.364776,VS0,VE144
set-cookie: sp_t=…; path=/; expires=Tue, 09 Nov 2027 03:29:12 GMT; domain=.spotify.com; samesite=none; secure
set-cookie: sp_landing=…; path=/; expires=Tue, 10 Nov 2026 03:29:12 GMT; domain=.spotify.com; samesite=none; secure; httponly
set-cookie: sp_t=…; Max-Age=31536000; Path=/; Domain=.spotify.com; Secure
set-cookie: sp_new=…; Max-Age=86400; Path=/; Domain=.spotify.com; Secure
set-cookie: sp_landing=…; Max-Age=86400; Path=/; Domain=.spotify.com; HttpOnly; Secure

Fetched from our server with a plain browser request. Headers can differ by region, or when you are signed in.