Embeddable on some sites only

Framing rules

• X-Frame-Options: SAMEORIGINdeny

  SAMEORIGIN allows a frame only on pages of the same origin.

• frame-ancestorsabsent

  No enforced Content-Security-Policy sets frame-ancestors.

• Set-Cookie × 1warning

  None of the 1 cookies go into a cross-site frame (sc_tracking_anonymous_id): a cookie needs SameSite=None; Secure for that. A login or session inside the frame can fail.

• Cross-Origin-Resource-Policyabsent

  Not sent. A cross-origin page with Cross-Origin-Embedder-Policy: require-corp cannot embed it.

HTTP 200 OK
cache-control: private, max-age=0, no-cache, no-store
cf-cache-status: DYNAMIC
cf-ray: a579bb30cbdb3524-CMH
connection: close
content-type: text/html
date: Mon, 09 Nov 2026 03:29:06 GMT
server: cloudflare
server-timing: enabledFeatures; dur=7.2919; desc="api-v2/enabledFeatures", geoip; dur=1.023718; desc="geoip/geoip", privacySettings; dur=5.442672; desc="api-v2/privacySettings", resolve; dur=39.436584; desc="api-v2/resolve", user; dur=16.4516; desc="api-v2/user", trackComments; dur=54.314245; desc="api-v2/trackComments"
strict-transport-security: max-age=63072000; includeSubdomains; preload
transfer-encoding: chunked
vary: Accept-Encoding
via: 1.1 4716bcbdc4e9f27ba0fec4fee66dbffa.cloudfront.net (CloudFront)
x-amz-cf-id: LYt91oxRZ6HMefIHUUt5UcglmZeAi-uXkmjlNrzMU38QfQ531lo1DQ==
x-amz-cf-pop: ORD58-P1
x-cache: Miss from cloudfront
x-frame-options: SAMEORIGIN
x-pants: distant-towel
x-xss-protection: 1; mode=block
set-cookie: sc_tracking_anonymous_id=…; path=/; expires=Wed, 08 Nov 2028 03:29:06 GMT; domain=.soundcloud.com

Fetched from our server with a plain browser request. Headers can differ by region, or when you are signed in.