costco.com Review

 N/A

HTTP/1.1 301 Moved Permanently
Connection: close
Content-Length: 0
Server: Varnish
Retry-After: 0
Location: https://costco.com/
Accept-Ranges: bytes
Date: Wed, 30 Sep 2026 21:51:19 GMT
Strict-Transport-Security: max-age=31536000;includeSubDomains
Set-Cookie: BCO=pm2; Domain=costco.com; Path=/; Secure

HTTP/1.1 301 Moved Permanently
Connection: close
Content-Length: 0
Server: Varnish
Retry-After: 0
Location: https://www.costco.com/
Accept-Ranges: bytes
Date: Wed, 30 Sep 2026 21:51:19 GMT
X-Timer: S1790805080.504928,VS0,VE4
Strict-Transport-Security: max-age=31536000;includeSubDomains
Set-Cookie: f_as=f4c4919359b1ec5951b83f3fc8996f8d~rv=14~sig=0xa144dc84f51e9d4101598a962c3ba863daf31b5326d05ae2f33e9c37117740c4; path=/; Secure; SameSite=None;
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400

HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 273992
x-costco-gdx-backend: external-web-backend
x-nextjs-prerender: 1
x-next-i18n-router-locale: en-us
etag: "s98qjox2cj1w6jf"
x-middleware-rewrite: /en-us
x-build-reference: 1.35.10-35790165015
x-nextjs-stale-time: 300
content-type: text/html; charset=utf-8
x-nextjs-cache: HIT
x-build-tag: release-v1.35.10
x-envoy-upstream-service-time: 89
x-costco-gdx-deployment: blue
content-security-policy: default-src 'self' https://*.queue-it.net/ https://*.costco.ca/ https://*.costco.com/ https://*.costcobusinessdelivery.com/ https://*.costcobusinesscentre.ca/ https://*.costcobusinesscenter.ca/ https://*.costco-static.com/ https://display.ugc.bazaarvoice.com/ https://api.bazaarvoice.com/; script-src 'self' https://*.dynatrace.com https://*.affirm.com https://h.costco.com/ https://js-cdn.dynatrace.com/ https://h.online-metrix.net/ https://*.cybersource.com/ https://www.google.com/recaptcha/ https://www.gstatic.com/ https://www.gstatic.com/recaptcha/ https://www.cdn-path.com/ https://h.costco.com/ https://dev.virtualearth.net/ https://sdk.virtualearth.net/ https://*.queue-it.net/ https://*.costcobusinessdelivery.com https://*.costcobusinesscenter.ca/ https://cdn.intake-lr.com/ https://cdn.cookielaw.org/ https://*.criteo.com/ http://*.criteo.com/ https://assets.adobedtm.com/ https://s.go-mpulse.net/ https://transcend-cdn.com/ https://apps.bazaarvoice.com/ https://agents.cloud.google.com/ https://display.ugc.bazaarvoice.com/ https://mobilecontent.costco.com/ https://mobilecontent-qa.costco.com/ https://*.pxlecdn.com https://*.pixlee.com https://*.pixlee.co https://fonts.googleapis.com https://yt3.googleusercontent.com/ 'unsafe-inline' 'unsafe-eval'; style-src 'self' https://*.affirm.com https://dev.virtualearth.net/ https://sdk.virtualearth.net/ https://cdn.fonts.net/ 'unsafe-inline' https://transcend-cdn.com/ https://consent.costco.com/ https://consent.costco.ca/ https://consent.costco.com https://display.ugc.bazaarvoice.com/ https://www.gstatic.com/; img-src 'self' https://dummyimage.com https://cdn.brandfolder.io/ https://*.affirm.com https://delivery-p178262-e1909084.adobeaemcloud.com https://retailmedia-static.criteo.com https://rmp-cdn.moloco.com/ https://*.costcobusinessdelivery.com https://*.tiles.virtualearth.net/ https://dev.virtualearth.net/ https://sdk.virtualearth.net/ https://*.costco.ca/ https://*.costco.com/ https://*.costcotravel.com/ https://*.costcotravel.ca/ https://cdn.bfldr.com/ https://*.contentstack.com/ https://*.costco-static.com/ https://cdn.cookielaw.org/ https://cm.everesttech.net/ https://dpm.demdex.net/ https://display.ugc.bazaarvoice.com https://retailmedia-static.azureedge.net https://retailmedia-static.azureedge.net/ https://network-a.bazaarvoice.com https://network-stg-a.bazaarvoice.com https://retailmedia-static.criteo.com/ https://yt3.googleusercontent.com/ https://gstatic.com/ https://www.gstatic.com/ https://services.google.com/ blob: data:; media-src 'self' https://*.costcobusinessdelivery.com https://*.costco.ca/ https://*.costco.com/ https://cdn.bfldr.com/ https://*.contentstack.com/ https://*.costco-static.com/ https://*.criteo.net/ https://retailmedia-static.criteo.com/ https://*.criteo.net; font-src 'self' https://*.affirm.com https://cdn.bfldr.com/ https://*.costco-static.com/ https://fonts.gstatic.com data:; object-src 'none'; base-uri 'self' about:; form-action 'self' https://*.cardinaltrusted.com https://*.cardinalcommerce.com https://www.cdn-path.com/ https://*.costcobusinessdelivery.com https://*.costco.ca/ https://*.costco.com/ https://r.intake-lr.com/ https://*.akstat.io https://*.opinionlab.com; frame-src https://*.affirm.com https://*.cardinaltrusted.com https://*.cardinalcommerce.com https://www.cdn-path.com/ https://h.costco.com/ https://h.online-metrix.net/ https://*.cybersource.com/ https://*.costcobusinessdelivery.com https://*.costcobusinesscentre.ca/ https://*.ct-costco.com https://costco.demdex.net/ https://costco.centah.com/ https://consent-sync.costco.com/ https://consent-sync.costco.ca/ https://*.criteo.com/ http://*.criteo.com https://*.pixlee.com https://*.pixlee.co https://*.costco.com/ https://*.costco.ca/ https://*.dynatrace.com https://login.centah.com/ https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/ https://cmppapi.cervey.com/; connect-src 'self' https://*.affirm.com https://rest.api.costco.com/ https://*.moloco.com https://*.rmp-api.moloco.com https://gdx-prd.api.cc-costco.com https://h.costco.com/ https://cdn.bfldr.com/ https://js-cdn.dynatrace.com/ https://*.dynatrace.com https://www.google.com/recaptcha/ https://gdx-api.costco.com https://gdx-npd.np.api.cc-costco.com https://api-tst.np.gdx.cc-costco.com https://dev.virtualearth.net/ https://sdk.virtualearth.net/ https://spatial.virtualearth.net/ https://*.queue-it.net/ https://*.costcobusinessdelivery.com/ https://*.costcobusinesscenter.ca/ https://*.costcobusinesscentre.ca/ https://*.costco.ca/ https://*.costco.com/ https://*.costco-static.com/ https://*.ct-costco.com https://cdn.cookielaw.org/ https://geolocation.onetrust.com/ https://costco.demdex.net/ https://dpm.demdex.net/ https://costco.tt.omtrdc.net/ https://*.criteo.com/ http://*.criteo.com/ https://*.criteo.net/ https://cm.everesttech.net/ https://r.intake-lr.com/ https://*.contentstack.com/ https://assets.adobedtm.com/ https://dcs.adobedc.net/ https://*.akstat.io https://*.go-mpulse.net/ https://*.akamaihd.net https://adobedc.demdex.net/ https://sync-transcend-cdn.com https://transcend-cdn.com/ https://telemetry.transcend.io/ https://telemetry.us.transcend.io/ https://privacyportal.onetrust.com/ https://consent.us.transcend.io/ https://api.bazaarvoice.com/ https://stg.api.bazaarvoice.com/ https://agenticapplications.googleapis.com/ https://rx.costco.com/ https://ces.googleapis.com/; child-src 'self' blob: data:; upgrade-insecure-requests;
Content-Encoding: gzip
Accept-Ranges: bytes
Date: Wed, 30 Sep 2026 21:51:19 GMT
X-Timer: S1790805080.862170,VS0,VE5
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000;includeSubDomains
Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate, private, max-age=0, s-maxage=0
Set-Cookie: f_as=f81a995575a6600eb9d5ca86a76dcd9d~rv=69~sig=0x7b4314153b764672cb4a9fb6e426465e86d9b87d457e721223f9705983ef0544; path=/; Secure; SameSite=None;
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400