Embeddable on some sites only

Framing rules

• X-Frame-Options: SAMEORIGINdeny

  SAMEORIGIN allows a frame only on pages of the same origin.

• frame-ancestorsabsent

  No enforced Content-Security-Policy sets frame-ancestors.

• Set-Cookie × 3warning

  2 of 3 cookies do not go into a cross-site frame (__Secure-STRP, SEARCH_SAMESITE): a cookie needs SameSite=None; Secure for that. A login or session inside the frame can fail.

• Cross-Origin-Resource-Policyabsent

  Not sent. A cross-origin page with Cross-Origin-Embedder-Policy: require-corp cannot embed it.

HTTP 200 OK
accept-ch: Downlink, RTT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
cf-cache-status: DYNAMIC
cf-ray: a579abfd2defddf0-CMH
connection: close
content-security-policy-report-only: object-src 'none';base-uri 'self';script-src 'nonce-KLiEwOFVQf1DpcPAOSepXQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/maps-tactile
content-type: text/html; charset=UTF-8
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
date: Mon, 09 Nov 2026 03:18:44 GMT
expires: -1
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/maps-tactile"}]}
reporting-endpoints: default="/maps/_/MapsWizUi/web-reports?context=eJwNwzFLAnEYwOH3qAyEMBAyGhwcnOT4n0KC-AGcwlDcHEROObgwKFAaI0SkybF3d3IycAtuaGtRzEzN_dbWpn4PPNHQOnlVOeXwQ2XEg7nK00JFlyr7T5Xkl8qMqbWKzTzv-Mijb5VzpllknW32OOCUIY83Kgles89nvjO-VSnwig226NHnmBO-MeCKvzzcqZyxzApv-cAXThjwj9aPSoQZGl7Eqo3mvee7pc6NW_PcbiqaNdlLxzE52_wDzsp0dw"
server: cloudflare
transfer-encoding: chunked
vary: accept-encoding
x-frame-options: SAMEORIGIN
x-xss-protection: 0
set-cookie: __Secure-STRP=…; expires=Mon, 09-Nov-2026 03:23:44 GMT; path=/; domain=.google.com; Secure; SameSite=strict
set-cookie: SEARCH_SAMESITE=…; expires=Sat, 08-May-2027 03:18:44 GMT; path=/; domain=.google.com; SameSite=strict
set-cookie: NID=…; expires=Tue, 11-May-2027 03:18:44 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none

Fetched from our server with a plain browser request. Headers can differ by region, or when you are signed in.