Embeddable on some sites only

Framing rules

• X-Frame-Options: SAMEORIGINdeny

  SAMEORIGIN allows a frame only on pages of the same origin.

• frame-ancestorsabsent

  No enforced Content-Security-Policy sets frame-ancestors.

• Set-Cookie × 4warning

  2 of 4 cookies do not go into a cross-site frame (tt_csrf_token, tt_chain_token): a cookie needs SameSite=None; Secure for that. A login or session inside the frame can fail.

• Cross-Origin-Resource-Policyabsent

  Not sent. A cross-origin page with Cross-Origin-Embedder-Policy: require-corp cannot embed it.

HTTP 200 OK
access-control-expose-headers: x-tt-traceflag,x-tt-logid
cache-control: max-age=0, no-cache, no-store
cf-cache-status: DYNAMIC
cf-ray: a579ac386fc7b23b-CMH
connection: close
content-security-policy: report-uri https://mon-i18n.tiktokv.com/monitor_browser/collect/batch/security/?bid=tiktok_pns&ev_type=csp&p=r9uhAe2913VU9Gwx8Z9uCG&v=6&s=370&b=oab; report-to csp-endpoint; upgrade-insecure-requests; default-src 'self' 'unsafe-eval' 'unsafe-inline' blob: bytedance: data: wss://*.tiktok.com wss://*.tiktokv.com wss://*.tiktokv.eu wss://tiktok.com wss://tiktokv.com *.adsco.re *.adsintegrity.net *.akamaized.net *.amazonaws.com *.arkoselabs.com *.billetlugen.dk *.bing.com *.bitssec.com *.bytedapm.com *.bytedgame.com *.bytehwm-row.com *.byteicdn.com *.byteintl.com *.byteintl.net *.byteintlapi.com *.byteintlstatic.com *.bytelemon.com *.byteoversea.com *.byteoversea.net *.bytevcloudapi.com *.capcut.com *.cloudflare.com *.ctfassets.net *.doubleclick.net *.entradas.com *.evbuc.com *.eventim.de *.facebook.com *.facebook.net *.fbsbx.com *.fcdnstatic-intl.com *.fdmstatic.com *.g-p-static.com *.gauthmath.com *.giphy.com *.goofy-cdn.com *.goofy.app *.google.com *.googleapis.com *.googletagmanager.com *.gstatic.com *.hsforms.com *.hsforms.net *.ibytedtos.com *.ibyteimg.com *.isnssdk.com *.jumio.ai *.kakao.com *.lemon8-app.com *.lemon8cdn.com *.licdn.com *.linkedin.com *.midtrans.com *.muscdn.com *.musical.ly *.oecstatic.com *.omise.co *.pangle-ads.com *.paypal.com *.pipopay.com *.redditstatic.com *.resso.me *.sgsnssdk.com *.soundon.global *.tableau.com *.tenor.com *.tiktok-row.net *.tiktok.com *.tiktok.ru *.tiktok.vn *.tiktokapis.com *.tiktokcdn-eu.com *.tiktokcdn-in.com *.tiktokcdn-us.com *.tiktokcdn.com *.tiktokcreativeone.com *.tiktokeu-cdn.com *.tiktokforbusinessoutbound.com *.tiktokglobalshop.com *.tiktokmusic.me *.tiktokshop.com *.tiktokstaticb.com *.tiktokus.info *.tiktokv.com *.tiktokv.eu *.tiktokv.us *.tiktokvapp.eu *.tiktokw.eu *.tiktokw.us *.topbuzzcdn.com *.ttlivecdn.com *.ttlstatic.com *.ttwstatic.com *.vimeo.com *.vodupload.com *.yahoo.co.jp *.yhgfb-static.com *.youtube-nocookie.com *.zhiliaoapp.com api-verification.tiktokshops.eu api.music.apple.com code.jquery.com facebook.com google.com i.ticketweb.com images.universe.com interactives.ap.org media.ticketmaster.eu play.itunes.apple.com res.cloudinary.com s1.ticketm.net static-label.frontgatetickets.com static.captchami.com t.co tikitoks.com tiktok.captchami.com tiktok.com tiktok.ua tiktok.vn tiktokfollowersfree.com tiktokv.com tx41v.arkoselabs.com unpkg.com v16-webapp-prime.tiktok.com vimeo.com webcast.tiktok.com sf-website-login-bak.tiktokcdn-eu.com; frame-src *.kakao.com *.tiktok.com access.line.me accounts.google.com api.twitter.com appleid.apple.com assets.braintreegateway.com client-api.arkoselabs.com h.online-metrix.net lf16-web.tiktokcdn.com newassets.hcaptcha.com recaptcha.google.com tx41v.arkoselabs.com www.facebook.com www.google.com; script-src 'report-sample' 'unsafe-eval' 'inline-speculation-rules' 'wasm-unsafe-eval' accounts.google.com apis.google.com c.paypal.com cdn.ampproject.org cdnjs.cloudflare.com client-api.arkoselabs.com code.jquery.com connect.facebook.net developers.kakao.com googleads.g.doubleclick.net interactives.ap.org js-cdn.music.apple.com/musickit/v3/musickit.js js.hcaptcha.com js.hsforms.net pay.google.com recaptcha.google.com s20.tiktokcdn.com s3.amazonaws.com sf16-website-login.neutral.tiktokcdn-eu.com sf16-website-login.neutral.ttwstatic.com sf16-website.neutral.tiktokcdn-eu.com sf16-website.neutral.ttwstatic.com sf16m-website-login.neutral.ttwstatic.com ssl.bing.com static.captchami.com tiktok.captchami.com tx41v.arkoselabs.com unpkg.com vimeo.com www.google.com www.googleadservices.com www.googleapis.com www.googletagmanager.com www.gstatic.com www.vimeo.com sf-website-login-bak.tiktokcdn-eu.com appleid.cdn-apple.com; worker-src www.tiktok.com/business/sw.js www.tiktok.com/creator/worker/ www.tiktok.com/embed/sw.js www.tiktok.com/firebase-messaging-sw.js www.tiktok.com/help/sw.js www.tiktok.com/live/creator-networks/pdf.worker.min.js www.tiktok.com/live/static/player-worker/ www.tiktok.com/risk-appeal-ocr/BlinkCardWasmSDK.worker.min.js www.tiktok.com/series/worker/ www.tiktok.com/sw.js www.tiktok.com/tiktokstudio/static/worker/ www.tiktok.com/tiktokstudio/sw.js www.tiktok.com/web-static-js/ www.tiktok.com/webapp-desktop/static/worker/
content-type: text/html; charset=utf-8
date: Mon, 09 Nov 2026 03:18:53 GMT
expires: Mon, 09 Nov 2026 03:18:53 GMT
feature-policy: microphone 'none'; geolocation 'none'
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
reporting-endpoints: csp-endpoint="https://mon-i18n.tiktokv.com/monitor_browser/collect/batch/security/?bid=tiktok_pns&ev_type=csp&p=r9uhAe2913VU9Gwx8Z9uCG&v=6&s=370&b=oab"
server: cloudflare
server-timing: cdn-cache; desc=MISS, edge; dur=22, origin; dur=218, inner; dur=215
strict-transport-security: max-age=31536000; includeSubdomains
transfer-encoding: chunked
tt-gateway-flag: v2
vary: accept-encoding
x-akamai-request-id: 60253ec.14b9a848
x-bytefaas-execution-duration: 206.13
x-bytefaas-request-id: 202611090318530DD9C8584CDD7A3347DC
x-cache: TCP_MISS from a23-64-113-201.deploy.akamaitechnologies.com (AkamaiGHost/22.7.0-c18a5259117e1d1b2cb0ace70ccfa9bb) (-)
x-cache-remote: TCP_MISS from a23-213-19-183.deploy.akamaitechnologies.com (AkamaiGHost/22.7.1-d04eda59fc1d0839d0412c36284b9f37) (-)
x-content-type-options: nosniff
x-download-options: noopen
x-envoy-response-flags: -
x-frame-options: SAMEORIGIN
x-gw-dst-psm: serverless.tiktok.desktop
x-ms-token: L_AFBg1xx8cVsn7h9oSdedvDBslY33QU0dGwS2VuwGBTK0tL_7lZrK6iI_14Txxe5uACHFCCZ2Zrnid0sM5l3OmUFGm_xE4p4OySfC14Jc-Gcxw24qR46na5bHo=
x-origin-response-time: 218,23.213.19.183
x-parent-response-time: 239,23.64.113.201
x-powered-by: Goofy Node
x-pumbaa-web-avail: 1
x-tt-logid: 202611090318530DD9C8584CDD7A3347DC
x-tt-trace-host: 013d595580aa720023e26a724ae28023b5f0f548480f0f6a8261b1153b57841a082b2dc9b5dbccdf02f0e6fa220254a45a706c70f87554b8a47b8c3a8c90653499efabd909758a9622f64741573494892cf3bba2c23fc83c036b4a9347b8975904a50d5e2068ffba7c8edb54847f85fe87664806b8b266158938ffff8fa512026d977c7c6311798a83ffcccb82f89df440db20064a2fd056769438dc5cd7883088077d48b7e2921bab90a582933e574d7384e0da4469225414eb01d5d0d87c2f45ac0e34c05ff675e6ec37caa18dc2ba5ef6e03c3506fbc7cfdf26545fcc32b46b
x-tt-trace-id: 00-2611090318530DD9C8584CDD7A3347DC-0BF0A4CA0E04819B-00
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-xss-protection: 1; mode=block
set-cookie: ttwid=…; Domain=.tiktok.com; Path=/; Expires=Thu, 04 Nov 2027 03:18:53 GMT; HttpOnly; Secure; SameSite=None
set-cookie: tt_csrf_token=…; path=/; domain=.tiktok.com; samesite=lax; secure; httponly
set-cookie: tt_chain_token=…; path=/; expires=Sat, 08 May 2027 03:18:53 GMT; domain=.tiktok.com; secure; httponly
set-cookie: msToken=…; Path=/; Expires=Thu, 19 Nov 2026 03:18:53 GMT; Secure; SameSite=None

Fetched from our server with a plain browser request. Headers can differ by region, or when you are signed in.