Embeddable on some sites only

Framing rules

• X-Frame-Options: SAMEORIGINignored

  Browsers ignore X-Frame-Options here, because CSP frame-ancestors is set and wins.

• frame-ancestors 'self' vscode-webview: vscode-file:some sites

  frame-ancestors limits framing to the listed sources.

• Set-Cookie × 4warning

  2 of 4 cookies do not go into a cross-site frame (product_locale, figma.session): a cookie needs SameSite=None; Secure for that. A login or session inside the frame can fail.

• Cross-Origin-Resource-Policyabsent

  Not sent. A cross-origin page with Cross-Origin-Embedder-Policy: require-corp cannot embed it.

HTTP 200 OK
alt-svc: h3=":443"; ma=86400
cache-control: private, no-store
cf-cache-status: DYNAMIC
cf-ray: a579bb48dfd33524-CMH
connection: close
content-location: https://www.figma.com/file/nrPSsILSYjesyc5UHjYYa4
content-security-policy: script-src 'wasm-unsafe-eval' 'nonce-F7Ve9+vj33kqHBoJi3eGCg==' 'strict-dynamic' 'report-sample' 'unsafe-eval' ; style-src 'self' 'unsafe-inline' https://www.figma.com/webpack-artifacts/ https://fonts.googleapis.com/ https://accounts.google.com/gsi/style https://cdnjs.cloudflare.com/ajax/libs/materialize/1.0.0/css/materialize.min.css ; worker-src 'self' blob: ; object-src 'none' ; base-uri 'self' ; form-action https://www.figma.com/exit https://*.makeproxy-c.figma.site/.well-known/figma/fs/read-file https://*.makeproxy-m.figma.site/.well-known/figma/fs/read-file https://*.tunnel.figma.site/.well-known/figma/fs/read-file ; frame-ancestors 'self' vscode-webview: vscode-file: , script-src 'self' https://www.figma.com/ 'wasm-unsafe-eval' 'unsafe-inline' 'report-sample' 'unsafe-eval' https://admin.figma.com/admin/webpack-artifacts/ https://figma-private-data.s3.us-west-2.amazonaws.com/webpack-artifacts/ blob: https://accounts.google.com/gsi/client https://static.figma.com/fullscreen/ https://static.figma.com/uploads/539fd13ba437049b058e7e83fd54539c86878320 https://static.figma.com/uploads/0706b46bdc09a419282285b791ea1dd3c019ecd6 https://static.figma.com/scripts/ https://static.zdassets.com https://ekr.zdassets.com https://assets.zendesk.com/apps/sdk/2.0/zaf_sdk.js https://js.stripe.com https://statics.teams.cdn.office.net/sdk/v1.6.0/js/MicrosoftTeams.min.js https://res.cdn.office.net/teams-js/2.48.1/js/MicrosoftTeams.min.js https://alcdn.msauth.net/browser/2.21.0/js/msal-browser.min.js https://apis.google.com/ ; worker-src 'self' blob:
content-security-policy-report-only: form-action https://www.figma.com/exit https://*.makeproxy-c.figma.site/.well-known/figma/fs/read-file https://*.makeproxy-m.figma.site/.well-known/figma/fs/read-file https://*.tunnel.figma.site/.well-known/figma/fs/read-file ; report-uri https://o22594.ingest.us.sentry.io/api/4508218677329920/security/?sentry_key=f2dd23d3c297716fae09358359456334&sentry_environment=prod&sentry_release=form_action
content-type: text/html;charset=utf-8
date: Mon, 09 Nov 2026 03:29:11 GMT
referrer-policy: origin-when-cross-origin
report-to: {"group":"default", "max_age":604800, "endpoints":[{"url":"https://www.figma.com/api/web_logger/browser_report?tsid=5QFZhRXFrx5cTWe7"}], "include_subdomains":true}
reporting-endpoints: default="https://www.figma.com/api/web_logger/browser_report?tsid=5QFZhRXFrx5cTWe7"
server: cloudflare
server-timing: cdn-upstream-layer;desc="EDGE",cdn-upstream-dns;dur=0,cdn-upstream-connect;dur=0,cdn-upstream-fbl;dur=539,proxyq;dur=6.6,app;dur=483.98;desc="id:s",streamed;desc="1",proxy;dur=492,cdn-cache-miss,cdn-pop;desc="CMH51-P1",cdn-rid;desc="NkAl9V8GFmtSjIChsZliG8Dq9ZBut4oeRr0qXkJxXvZDTCeHk4Lwfw==",cdn-downstream-fbl;dur=545
strict-transport-security: max-age=31536000; includeSubDomains; preload
transfer-encoding: chunked
vary: Accept-Encoding
via: 1.1 8c050dd8b19af4e6671c8c58f868633e.cloudfront.net (CloudFront)
x-amz-cf-id: NkAl9V8GFmtSjIChsZliG8Dq9ZBut4oeRr0qXkJxXvZDTCeHk4Lwfw==
x-amz-cf-pop: CMH51-P1
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-preload-streaming: true
x-robots-tag: noindex
set-cookie: __Host-figma.did=…; path=/; expires=Tue, 09 Nov 2027 03:29:10 -0000; secure; HttpOnly; SameSite=None
set-cookie: ajs_anonymous_id=…; domain=.figma.com; path=/; expires=Wed, 09 Dec 2026 03:29:10 -0000; secure; SameSite=None
set-cookie: product_locale=…; path=/; max-age=31536000; expires=Tue, 09 Nov 2027 03:29:11 GMT; SameSite=Lax
set-cookie: figma.session=…; domain=.www.figma.com; path=/; expires=Sat, 19 Dec 2026 03:29:11 GMT; secure; HttpOnly; SameSite=Lax

Fetched from our server with a plain browser request. Headers can differ by region, or when you are signed in.