Technical Information
| HTTP Status Code | 200 |
| HTTP Version | HTTP/1.1 |
| HTTPS | ✔ Available |
| IP Address | 35.186.224.24 |
| Server Software | envoy |
| CDN | CDN (MISS) |
| Compression | gzip |
|
ℹ 🔵 Missing X-Frame-Options | The site can be embedded in iframes by third parties (clickjacking risk). |
HTTP Status Code 200
HTTP Version HTTP/1.1
HTTPS ✔ Available
IP Address 35.186.224.24
Server Software envoy
CDN CDN (MISS)
Compression gzip
ℹ 🔵 Missing X-Frame-Options The site can be embedded in iframes by third parties (clickjacking risk).
Redirect Chain
| # | URL | HTTP Status Code | Status |
| 1 | https://spotify.com:443 | 301 | HTTP/2 301 |
| 2 | https://www.spotify.com/ | 301 | HTTP/2 301 |
| 3 | https://open.spotify.com/ | 200 | HTTP/2 200 |
#1 URL https://spotify.com:443
HTTP Status Code 301
Status HTTP/2 301
#2 URL https://www.spotify.com/
HTTP Status Code 301
Status HTTP/2 301
#3 URL https://open.spotify.com/
HTTP Status Code 200
Status HTTP/2 200
Performance
| DNS Lookup | 2.7 ms |
| TCP Connect | 3.9 ms |
| TLS Handshake | 4.4 ms |
| Time To First Byte (TTFB) | 40.8 ms |
| Content Download | 1.3 ms |
| Total Response Time | 42.1 ms |
DNS Lookup 2.7 ms
TCP Connect 3.9 ms
TLS Handshake 4.4 ms
Time To First Byte (TTFB) 40.8 ms
Content Download 1.3 ms
Total Response Time 42.1 ms
Security
| HTTPS | ✔ Enabled |
| HSTS | ✔ max-age=31536000 |
| CSP | ✔ Configured |
| X-Frame-Options | ⚠ Not configured |
| X-Content-Type-Options | ✔ nosniff |
| HTTP/2 | ⚠ HTTP/1.1 |
HTTPS ✔ Enabled
HSTS ✔ max-age=31536000
CSP ✔ Configured
X-Frame-Options ⚠ Not configured
X-Content-Type-Options ✔ nosniff
HTTP/2 ⚠ HTTP/1.1
SEO Quick Check
| Title | Spotify – Web Player |
| Canonical | https://open.spotify.com/ |
Title Spotify – Web Player
Canonical https://open.spotify.com/
Detected Technologies
| Technology | Google Analytics Google Tag Manager Hotjar |
Technology Google Analytics Google Tag Manager Hotjar
HTTP Headers
| Set-cookie
| sp_landing=https%3A%2F%2Fopen.spotify.com%2F; Max-Age=86400; Path=/; Domain=.spotify.com; HttpOnly; Secure |
| Content-security-policy
| script-src 'self' 'unsafe-eval' blob: open.spotifycdn.com open-review.spotifycdn.com quicksilver.scdn.co www.google-analytics.com www.googletagmanager.com static.ads-twitter.com analytics.twitter.com s.pinimg.com sc-static.net https://www.google.com/recaptcha/ cdn.ravenjs.com connect.facebook.net www.gstatic.com sb.scorecardresearch.com pixel-static.spotify.com cdn.cookielaw.org geolocation.onetrust.com www.fastly-insights.com static.hotjar.com script.hotjar.com https://www.googleadservices.com/pagead/conversion_async.js https://www.googleadservices.com/pagead/conversion/ https://analytics.tiktok.com/i18n/pixel/sdk.js https://analytics.tiktok.com/i18n/pixel/identify.js https://analytics.tiktok.com/i18n/pixel/config.js https://www.redditstatic.com/ads/pixel.js https://t.contentsquare.net/uxa/22f14577e19f3.js https://get.microsoft.com/badge/ms-store-badge.bundled.js https://cdn.us.heap-api.com https://heapanalytics.com 'sha256-WfsTi7oVogdF9vq5d14s2birjvCglqWF842fyHhzoNw=' 'sha256-KRzjHxCdT8icNaDOqPBdY0AlKiIh5F8r4bnbe1PQwss=' 'sha256-Z5wh7XXSBR1+mTxLSPFhywCZJt77+uP1GikAgPIsu2s=' 'sha256-o2wzIImHJ4+WWE5DCTR+myWU0UNml0+wwpDXRo++vII='; frame-ancestors 'self' https://adgen-dev.spotify.com/account/*/ad/*/details https://adgen-dev.spotify.com/preview/* https://local.spotify.net/account/*/ad/*/details https://local.spotify.net/preview/* https://app.smartly.io/*; |
| Content-type
| text/html; charset=utf-8 |
| X-spotify-open-index
| true |
| X-envoy-upstream-service-time
| 9 |
| Server
| envoy |
| Via
| HTTP/1.1 fringe, HTTP/2 edgeproxy, 1.1 google, 1.1 varnish |
| Strict-transport-security
| max-age=31536000 |
| X-content-type-options
| nosniff |
| Content-encoding
| gzip |
| Accept-ranges
| bytes |
| Date
| Sat, 22 Aug 2026 07:31:40 GMT |
| X-served-by
| cache-par-lfpb1150094-PAR |
| X-cache
| MISS |
| X-cache-hits
| 0 |
| X-timer
| S1787383901.925687,VS0,VE31 |
| Vary
| Accept-Encoding |
Meta Tags
| X-UA-Compatible | IE=9 |
| Viewport | width=device-width, initial-scale=1, maximum-scale=1 |
| Fb:app_id | 174829003346 |
Set-cookie sp_landing=https%3A%2F%2Fopen.spotify.com%2F; Max-Age=86400; Path=/; Domain=.spotify.com; HttpOnly; Secure
Content-security-policy script-src 'self' 'unsafe-eval' blob: open.spotifycdn.com open-review.spotifycdn.com quicksilver.scdn.co www.google-analytics.com www.googletagmanager.com static.ads-twitter.com analytics.twitter.com s.pinimg.com sc-static.net https://www.google.com/recaptcha/ cdn.ravenjs.com connect.facebook.net www.gstatic.com sb.scorecardresearch.com pixel-static.spotify.com cdn.cookielaw.org geolocation.onetrust.com www.fastly-insights.com static.hotjar.com script.hotjar.com https://www.googleadservices.com/pagead/conversion_async.js https://www.googleadservices.com/pagead/conversion/ https://analytics.tiktok.com/i18n/pixel/sdk.js https://analytics.tiktok.com/i18n/pixel/identify.js https://analytics.tiktok.com/i18n/pixel/config.js https://www.redditstatic.com/ads/pixel.js https://t.contentsquare.net/uxa/22f14577e19f3.js https://get.microsoft.com/badge/ms-store-badge.bundled.js https://cdn.us.heap-api.com https://heapanalytics.com 'sha256-WfsTi7oVogdF9vq5d14s2birjvCglqWF842fyHhzoNw=' 'sha256-KRzjHxCdT8icNaDOqPBdY0AlKiIh5F8r4bnbe1PQwss=' 'sha256-Z5wh7XXSBR1+mTxLSPFhywCZJt77+uP1GikAgPIsu2s=' 'sha256-o2wzIImHJ4+WWE5DCTR+myWU0UNml0+wwpDXRo++vII='; frame-ancestors 'self' https://adgen-dev.spotify.com/account/*/ad/*/details https://adgen-dev.spotify.com/preview/* https://local.spotify.net/account/*/ad/*/details https://local.spotify.net/preview/* https://app.smartly.io/*;
Content-type text/html; charset=utf-8
X-spotify-open-index true
X-envoy-upstream-service-time 9
Server envoy
Via HTTP/1.1 fringe, HTTP/2 edgeproxy, 1.1 google, 1.1 varnish
Strict-transport-security max-age=31536000
X-content-type-options nosniff
Content-encoding gzip
Accept-ranges bytes
Date Sat, 22 Aug 2026 07:31:40 GMT
X-served-by cache-par-lfpb1150094-PAR
X-cache MISS
X-cache-hits 0
X-timer S1787383901.925687,VS0,VE31
Vary Accept-Encoding
