Embeddable on some sites only

Framing rules

• X-Frame-Options: SAMEORIGINignored

  Browsers ignore X-Frame-Options here, because CSP frame-ancestors is set and wins.

• frame-ancestors 'self'some sites

  frame-ancestors limits framing to the listed sources.

• Set-Cookie × 2warning

  None of the 2 cookies go into a cross-site frame (_osm_session, _osm_totp_token): a cookie needs SameSite=None; Secure for that. A login or session inside the frame can fail.

• Cross-Origin-Resource-Policyabsent

  Not sent. A cross-origin page with Cross-Origin-Embedder-Policy: require-corp cannot embed it.

HTTP 200 OK
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: max-age=0, private, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: a579bb2499683524-CMH
connection: close
content-language: en
content-security-policy: default-src 'self'; child-src 'self'; font-src 'self'; frame-ancestors 'self'; frame-src 'self'; manifest-src 'self'; media-src 'none'; object-src 'none'; worker-src blob:; connect-src 'self' tile.openstreetmap.org api.thunderforest.com tile.tracestrack.com *.openstreetmap.fr vector.openstreetmap.org api.maptiler.com matomo.openstreetmap.org http://127.0.0.1:8111 https://vector.openstreetmap.org https://api.maptiler.com https://tile.thunderforest.com https://render.openstreetmap.org https://nominatim.openstreetmap.org/ https://query.openstreetmap.org/query-features https://routing.openstreetmap.de/ https://graphhopper.com/api/1/route https://valhalla1.openstreetmap.de/route https://www.wikidata.org/w/api.php https://commons.wikimedia.org; form-action 'self' render.openstreetmap.org tile.thunderforest.com; img-src 'self' data: www.gravatar.com *.wp.com tile.openstreetmap.org gps.tile.openstreetmap.org api.thunderforest.com tile.tracestrack.com *.openstreetmap.fr matomo.openstreetmap.org https://openstreetmap-user-avatars.s3.dualstack.eu-west-1.amazonaws.com https://openstreetmap-gps-images.s3.dualstack.eu-west-1.amazonaws.com https://commons.wikimedia.org upload.wikimedia.org thumb.wikimedia.org; script-src 'self' matomo.openstreetmap.org 'wasm-unsafe-eval' 'nonce-8HUGQmLuVyGdqn2alEmpbxAR5FDoGz8j'; style-src 'self' 'unsafe-inline' 'nonce-8HUGQmLuVyGdqn2alEmpbxAR5FDoGz8j'
content-type: text/html; charset=utf-8
cross-origin-opener-policy: same-origin
date: Mon, 09 Nov 2026 03:29:05 GMT
etag: W/"67e8a42fc628b3cff2d0f64e91cabeb5-br"
link: </assets/index-eb6d4fe5706e2fee7699d6571ce8520addd3daedd794af5d632c84d9145edc06.js>; rel=preload; as=script; nopush,</assets/turbo-c17cce38062be94687ab3e688cf14213be635ee2b55e63d9d5778659fab0c27b.js>; rel=modulepreload; as=script; nopush,</assets/application-51f95e852077544f9446ba54e7f803574766433fbe9fc9f73af4f0fad73e4205.js>; rel=preload; as=script; nopush,</assets/i18n/en-83d0da0813ba7219cd52f970c9ff50214a87b448d7de780c86130ea543f8a338.js>; rel=preload; as=script; nopush,</assets/screen-auto-ltr-d1fba5979d2f387276d738920086742b0f4116326208bcd5cb034f984def84cb.css>; rel=preload; as=style; nopush,</assets/print-ltr-97dee1ca487394c852f28c2906a930316ab6d2cacf7f73e47c1c31fad8919051.css>; rel=preload; as=style; nopush,</assets/leaflet-all-d3e8505f47e0f0615d3daf2619f2267c086cbe9e17e276f393ee686dca54e0d3.css>; rel=preload; as=style; nopush,</assets/maplibre-gl-all-20d18df1d89490f1022cce8a156e2ff3958396ddad7f015c94b31f4da45543e6.css>; rel=preload; as=style; nopush
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
status: 200 OK
strict-transport-security: max-age=31536000; includeSubDomains; preload
transfer-encoding: chunked
vary: Accept-Language,Turbo-Frame,Accept-Encoding
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-page-title: OpenStreetMap
x-permitted-cross-domain-policies: none
x-powered-by: Phusion Passenger(R) 6.2.1
x-request-id: avE-AWV7FPbrGTLE1HiIrgAAAd0
x-runtime: 0.016050
x-served-by: cache-cmh1290028-CMH
x-timer: S1794194945.792311,VS0,VE331
x-xss-protection: 0
set-cookie: _osm_session=…; path=/; secure; httponly; samesite=lax
set-cookie: _osm_totp_token=…; domain=openstreetmap.org; path=/; expires=Mon, 09 Nov 2026 04:29:05 GMT; secure; httponly; samesite=lax

Fetched from our server with a plain browser request. Headers can differ by region, or when you are signed in.