Embeddable on any site

Framing rules

• X-Frame-Optionsabsent

  The page sends no X-Frame-Options.

• frame-ancestorsabsent

  No enforced Content-Security-Policy sets frame-ancestors.

• Set-Cookie × 5warning

  3 of 5 cookies do not go into a cross-site frame (country, CALENDLY_AUTHENTICATED_USER_STATUS, cal_anonymous_id): a cookie needs SameSite=None; Secure for that. A login or session inside the frame can fail.

• Cross-Origin-Resource-Policyabsent

  Not sent. A cross-origin page with Cross-Origin-Embedder-Policy: require-corp cannot embed it.

HTTP 200 OK
accept-ranges: bytes
cache-control: no-store, no-cache, must-revalidate, max-age=0, s-maxage=0
cf-cache-status: DYNAMIC
cf-ray: a579abfd2df7ddf0-CMH
connection: close
content-security-policy-report-only: default-src 'self' https:; base-uri 'self'; object-src 'none'; script-src 'self' https: 'report-sample'; style-src 'self' https: 'report-sample'; img-src 'self' data: https:; font-src 'self' data: https:; connect-src 'self' https: wss:; report-uri /csp-reporting; report-to csp-reporting
content-type: text/html
cross-origin-opener-policy: same-origin
date: Mon, 09 Nov 2026 03:18:44 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
last-modified: Fri, 06 Nov 2026 19:45:32 GMT
reporting-endpoints: csp-reporting="https://calendly.com/csp-reporting"
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
transfer-encoding: chunked
vary: Origin
via: 1.1 ede5c6921f45d3b45a7afce27d144cda.cloudfront.net (CloudFront)
x-amz-cf-id: 1npKCKeYWe7AaUBOgNFVZrvNADo5_5vvx21yMOzYJLYXqFnNrlzYMg==
x-amz-cf-pop: CMH68-P5
x-amz-server-side-encryption: AES256
x-amz-version-id: nH6XZuEwM9fdrdCIvohu1NZYULS1uItO
x-cache: Hit from cloudfront
x-content-type-options: nosniff
x-country-code: US
set-cookie: country=…; path=/; Secure; SameSite=Strict
set-cookie: CALENDLY_AUTHENTICATED_USER_STATUS=…; path=/; Secure; SameSite=Strict
set-cookie: cal_anonymous_id=…; path=/; max-age=31536000; Secure; SameSite=Lax
set-cookie: __cf_bm=…; HttpOnly; SameSite=None; Partitioned; Secure; Path=/; Domain=calendly.com; Expires=Mon, 09 Nov 2026 03:48:44 GMT
set-cookie: _cfuvid=…; HttpOnly; SameSite=None; Secure; Path=/; Domain=calendly.com

Fetched from our server with a plain browser request. Headers can differ by region, or when you are signed in.