Embeddable on any site

Framing rules

• X-Frame-Optionsabsent

  The page sends no X-Frame-Options.

• frame-ancestorsabsent

  No enforced Content-Security-Policy sets frame-ancestors.

• Set-Cookie × 1ok

  Every cookie uses SameSite=None; Secure, so Chrome sends it in a cross-site frame. All of them are Partitioned (CHIPS), so each embedding site gets its own copy.

• Cross-Origin-Resource-Policyabsent

  Not sent. A cross-origin page with Cross-Origin-Embedder-Policy: require-corp cannot embed it.

HTTP 200 OK
cache-control: no-store
cf-ray: a579bb1cbd9f3524-CMH
connection: close
content-type: text/html;charset=UTF-8
date: Mon, 09 Nov 2026 03:29:02 GMT
server: cloudflare
transfer-encoding: chunked
x-backend: next
x-edge-version: 2026-11-03T10:41:07.663Z (7d2d419)
x-link-match: 0
x-route: exact /#clip_id *
x-vimeo-edge: 1
set-cookie: __cf_bm=…; HttpOnly; SameSite=None; Partitioned; Secure; Path=/; Domain=vimeo.com; Expires=Mon, 09 Nov 2026 03:59:03 GMT

Fetched from our server with a plain browser request. Headers can differ by region, or when you are signed in.