Embeddable on any site

Framing rules

• X-Frame-Optionsabsent

  The page sends no X-Frame-Options.

• frame-ancestorsabsent

  No enforced Content-Security-Policy sets frame-ancestors.

• Set-Cookie × 2ok

  Every cookie uses SameSite=None; Secure, so Chrome sends it in a cross-site frame. Safari blocks third-party cookies, and Firefox keeps a separate copy for each site that embeds the page. Add Partitioned (CHIPS) to keep them working in more browsers.

• Cross-Origin-Resource-Policyabsent

  Not sent. A cross-origin page with Cross-Origin-Embedder-Policy: require-corp cannot embed it.

HTTP 200 OK
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: a579ac0ee8a9ddf0-CMH
connection: close
content-type: text/html; charset=utf-8
date: Mon, 09 Nov 2026 03:18:46 GMT
server: cloudflare
transfer-encoding: chunked
vary: accept-encoding
via: 1.1 google
x-powered-by: Express
set-cookie: __cf_bm=…; HttpOnly; SameSite=None; Partitioned; Secure; Path=/; Domain=codesandbox.io; Expires=Mon, 09 Nov 2026 03:48:46 GMT
set-cookie: _cfuvid=…; HttpOnly; SameSite=None; Secure; Path=/; Domain=codesandbox.io

Fetched from our server with a plain browser request. Headers can differ by region, or when you are signed in.