Walmart.com - Photos.walmart.com

server: nginx/1.27.1
date: Tue, 10 Nov 2026 00:45:33 GMT
content-type: text/html; charset=utf-8
content-length: 0
location: https://photos3.walmart.com/
cache-control: no-cache
x-request-id: 0eb2390d-986b-4a1c-966c-abd4c71be751
x-runtime: 0.016729
x-cloud-trace-context: e0ced30a82f37e8df57a02533db0cbe2/17119959027158967518;o=0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
referrer-policy: strict-origin-when-cross-origin
content-security-policy: default-src 'self' https: data: blob:; connect-src 'self' https: wss: data: blob:; font-src 'self' https: data:; frame-src 'self' *.pinterest.com *.criteo.com *.facebook.com players.brightcove.net *.doubleclick.net *.livelinklabs.com *.quantummetric.com player.vimeo.com urldefense.com *.googletagmanager.com *.clarity.ms *.walmart.com; img-src 'self' https: data: blob: *.googleusercontent.com; object-src 'self'; script-src https: 'unsafe-inline' 'unsafe-eval' 'self' blob:; style-src 'self' https: 'unsafe-inline'; worker-src 'self' blob: cdn.jsdelivr.net
content-security-policy-report-only: default-src 'self'; base-uri 'self'; connect-src 'self' blob: data: wss://*.pusher.com *.pusher.com *.nr-data.net cognito-identity.us-east-1.amazonaws.com *.pinterest.com region1.analytics.google.com *.amazonaws.com stats.g.doubleclick.net *.googleapis.com *.clarity.ms *.google-analytics.com *.google.co.uk *.google.com *.google.ca *.walmart.com *.facebook.com prism-embellishments-service-qzsuxnaeka-ew.a.run.app *.googlesyndication.com *.criteo.com *.criteo.net *.rlcdn.com *.adnxs.com *.liadm.com *.rezync.com *.rfihub.com pippio.com *.doubleclick.net *.quantummetric.com *.adsrvr.org *.wmt.co; font-src 'self' data: *.cloudflare.com *.gstatic.com *.wal.co *.fontawesome.com *.walmart.com *.paypalobjects.com *.jsdelivr.net static.zip.co; frame-src 'self' *.pinterest.com *.criteo.com *.facebook.com players.brightcove.net *.doubleclick.net *.livelinklabs.com *.quantummetric.com player.vimeo.com urldefense.com *.googletagmanager.com *.clarity.ms *.walmart.com; img-src 'self' data: blob: *.cloudflare.com *.pinterest.com *.googleapis.com *.gstatic.com *.facebook.com *.google-analytics.com *.google.co.uk *.google.com *.google.ca *.walmart.com *.googletagmanager.com *.walmartimages.com *.bing.com *.clarity.ms *.criteo.com *.criteo.net *.rlcdn.com *.adnxs.com *.rezync.com *.rfihub.com pippio.com *.doubleclick.net prism-embellishments-service-qzsuxnaeka-ew.a.run.app *.googleusercontent.com *.livelink.io *.fillr.com localhost:3003 *.jsdelivr.net *.adsrvr.org *.wmt.co *.liadm.com; manifest-src 'self'; media-src 'self'; object-src 'none'; script-src 'report-sample' 'self' 'unsafe-inline' 'unsafe-eval' *.googleapis.com *.cloudflare.com *.facebook.net *.newrelic.com *.nr-data.net *.bootstrapcdn.com *.pinimg.com *.amazonaws.com *.criteo.com *.criteo.net *.rlcdn.com *.adnxs.com *.rezync.com *.rfihub.com pippio.com *.doubleclick.net *.myvisualiq.net *.clarity.ms *.google-analytics.com *.googletagmanager.com *.wal.co *.walmart.com *.jsdelivr.net *.pinterest.com *.adsrvr.org *.google.com *.wmt.co; style-src 'report-sample' 'self' 'unsafe-inline' *.honey.io *.cloudflare.com *.quilljs.com *.jquery.com *.googleapis.com *.fontawesome.com *.walmart.com *.bootstrapcdn.com *.jsdelivr.net; worker-src 'self' blob: cdn.jsdelivr.net; report-uri https://api.honeybadger.io/v1/browser/csp?api_key=hbp_fAF1FGsUTIexR67s96m2j6WBG4c0X90U9BQz&env=walmart-prod-report-only
via: 1.1 google
strict-transport-security: max-age=31557600,max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

HTTP/2 200 
server: nginx/1.27.1
date: Tue, 10 Nov 2026 00:45:33 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding,Accept
link: </stylesheets/default.css?version=v0000.00.00.0000-100.989>; rel=preload; as=style; nopush,</javascripts/libs/jquery-3.7.0.min.js>; rel=preload; as=script; nopush,</javascripts/libs/popper-1.12.9/umd/popper.min.js>; rel=preload; as=script; nopush,</javascripts/libs/bootstrap.min.js>; rel=modulepreload; as=script; nopush,</javascripts/libs/slick-carousel-1.8.1/slick.min.js>; rel=modulepreload; as=script; nopush,</vite/assets/application-O_LpOKAi.js>; rel=modulepreload; as=script; crossorigin=; nopush,</vite/assets/mega-menu-ByoO9jsL.js>; rel=modulepreload; as=script; crossorigin=; nopush,</vite/assets/mobile-side-menu-IUISgeKj.js>; rel=modulepreload; as=script; crossorigin=; nopush,</vite/assets/cart-merged-notification-CwbroinN.js>; rel=modulepreload; as=script; crossorigin=; nopush,</vite/assets/select-BONJLkys.css>; rel=preload; as=style; crossorigin=; nopush,</vite/assets/location-sidebar-BpqpPT4z.js>; rel=modulepreload; as=script; crossorigin=; nopush
etag: W/"0cee3e26b0d1388c4468b9bb825c790d"
cache-control: max-age=0, private, must-revalidate
set-cookie: _web-kiosk_session=Rkt3RWM5bDhQb2p3OVBDVVRwMXFVeGVEeUxYa2hmbnllbmFhdVRGekdDczV6YjhnOGwrcTlEbDFUTkFIUkJVbVBUUmRQa2wxVDdLYUpSRGtXSS82V2F2OUdFWHB3NUxrK2xYMW5paTlCemgrL1AweUxwMUQzaFA0d21LV0dpMVo2bHBPVXF4M2V5aDZQQUdMcUNwaUdBPT0tLUZBRWpERVFKWkhEU0VtbkdaM25KVXc9PQ%3D%3D--6759f18cc01e117812b7f5d70756ecd41ea3885e; path=/; secure; httponly; samesite=lax
x-request-id: 5a3d530c-8f54-44cb-9c88-7bec0902cfbb
x-runtime: 0.075675
x-cloud-trace-context: 34e4651a0d890a259689342aba434534/1776321327969927970;o=0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-download-options: noopen
x-permitted-cross-domain-policies: none
referrer-policy: strict-origin-when-cross-origin
content-security-policy: default-src 'self' https: data: blob:; connect-src 'self' https: wss: data: blob:; font-src 'self' https: data:; frame-src 'self' *.pinterest.com *.criteo.com *.facebook.com players.brightcove.net *.doubleclick.net *.livelinklabs.com *.quantummetric.com player.vimeo.com urldefense.com *.googletagmanager.com *.clarity.ms *.walmart.com; img-src 'self' https: data: blob: *.googleusercontent.com; object-src 'self'; script-src https: 'unsafe-inline' 'unsafe-eval' 'self' blob:; style-src 'self' https: 'unsafe-inline'; worker-src 'self' blob: cdn.jsdelivr.net
content-security-policy-report-only: default-src 'self'; base-uri 'self'; connect-src 'self' blob: data: wss://*.pusher.com *.pusher.com *.nr-data.net cognito-identity.us-east-1.amazonaws.com *.pinterest.com region1.analytics.google.com *.amazonaws.com stats.g.doubleclick.net *.googleapis.com *.clarity.ms *.google-analytics.com *.google.co.uk *.google.com *.google.ca *.walmart.com *.facebook.com prism-embellishments-service-qzsuxnaeka-ew.a.run.app *.googlesyndication.com *.criteo.com *.criteo.net *.rlcdn.com *.adnxs.com *.liadm.com *.rezync.com *.rfihub.com pippio.com *.doubleclick.net *.quantummetric.com *.adsrvr.org *.wmt.co; font-src 'self' data: *.cloudflare.com *.gstatic.com *.wal.co *.fontawesome.com *.walmart.com *.paypalobjects.com *.jsdelivr.net static.zip.co; frame-src 'self' *.pinterest.com *.criteo.com *.facebook.com players.brightcove.net *.doubleclick.net *.livelinklabs.com *.quantummetric.com player.vimeo.com urldefense.com *.googletagmanager.com *.clarity.ms *.walmart.com; img-src 'self' data: blob: *.cloudflare.com *.pinterest.com *.googleapis.com *.gstatic.com *.facebook.com *.google-analytics.com *.google.co.uk *.google.com *.google.ca *.walmart.com *.googletagmanager.com *.walmartimages.com *.bing.com *.clarity.ms *.criteo.com *.criteo.net *.rlcdn.com *.adnxs.com *.rezync.com *.rfihub.com pippio.com *.doubleclick.net prism-embellishments-service-qzsuxnaeka-ew.a.run.app *.googleusercontent.com *.livelink.io *.fillr.com localhost:3003 *.jsdelivr.net *.adsrvr.org *.wmt.co *.liadm.com; manifest-src 'self'; media-src 'self'; object-src 'none'; script-src 'report-sample' 'self' 'unsafe-inline' 'unsafe-eval' *.googleapis.com *.cloudflare.com *.facebook.net *.newrelic.com *.nr-data.net *.bootstrapcdn.com *.pinimg.com *.amazonaws.com *.criteo.com *.criteo.net *.rlcdn.com *.adnxs.com *.rezync.com *.rfihub.com pippio.com *.doubleclick.net *.myvisualiq.net *.clarity.ms *.google-analytics.com *.googletagmanager.com *.wal.co *.walmart.com *.jsdelivr.net *.pinterest.com *.adsrvr.org *.google.com *.wmt.co; style-src 'report-sample' 'self' 'unsafe-inline' *.honey.io *.cloudflare.com *.quilljs.com *.jquery.com *.googleapis.com *.fontawesome.com *.walmart.com *.bootstrapcdn.com *.jsdelivr.net; worker-src 'self' blob: cdn.jsdelivr.net; report-uri https://api.honeybadger.io/v1/browser/csp?api_key=hbp_fAF1FGsUTIexR67s96m2j6WBG4c0X90U9BQz&env=walmart-prod-report-only
x-cluster: Main
content-encoding: gzip
via: 1.1 google
strict-transport-security: max-age=31557600,max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000