Iframe Tester
Test website embedding and crawler access. Start with an iframe URL below.
Testing Googlebot, Bingbot or AI bots? Open crawler tester →Check how your website embeds and responds to crawlers
Use IframeTester to investigate two different access problems: a page that will not display in an iframe, or a page that responds differently to a search or AI crawler.
Test whether a page can be fetched with a selected bot's User-Agent. Actual bot access may differ if the website applies IP-based restrictions.
One iframe test, two different signals
A useful iframe checker needs to inspect the server response and the browser result. Either one alone can miss important failure modes.
X-Frame-Options
Detects DENY and SAMEORIGIN response headers that can prevent a page from loading inside a frame.
CSP frame-ancestors
Reads the modern Content Security Policy directive that tells browsers which parent origins may frame a page.
Browser preview
Loads the destination in a real iframe so you can catch problems that a header-only check cannot fully predict.
Test an iframe before you ship the embed
- Paste the exact URL you plan to embed. Use the final page URL when possible, including the correct HTTPS scheme.
- Add the embedding website when it matters. If the page will be framed on a specific site, enter that parent origin so SAMEORIGIN and CSP allowlists are evaluated against the real embedding context.
- Run the iframe test. The server checks the final response headers after a small number of redirects.
- Read the verdict. A DENY or SAMEORIGIN X-Frame-Options value is highlighted. CSP frame-ancestors is shown separately because it supports more precise allowlists.
- Check the live preview. A header result can say a page is likely embeddable while browser behavior still fails because of JavaScript, authentication, storage restrictions or an application-specific rule.
- Copy the result link or embed code. Only the copied result link includes the test URL. Opening that link prefills the form; select Render iframe to run it.
Important: this tool is for testing compatibility, not bypassing security controls. A destination site decides whether it may be framed.
Use the tester as an iframe viewer, too
Use Fit for a full-width view, or choose Mobile, Tablet, Desktop or Custom to inspect a specific frame size. These controls resize the iframe; they do not change the destination's framing policy.
Standard mode behaves like a normal iframe. Restricted mode adds a sandbox and removes the referrer, so a page may behave differently. If the destination blocks framing, changing the preview size will not bypass it.
Why an iframe can be blocked
X-Frame-Options blocks the page
X-Frame-Options: DENY tells the browser not to render the page in a frame at all. SAMEORIGIN permits framing only when the parent and child are from the same origin. The older ALLOW-FROM value should not be relied on in modern browsers.
CSP frame-ancestors limits the allowed parent
Content Security Policy provides a more flexible control through frame-ancestors. A page can allow itself, a specific list of trusted origins, or no parent at all. The directive is different from frame-src: frame-ancestors controls who can embed the current page, while frame-src controls what the current page may load into its own frames.
The browser has another reason to refuse the embed
Framing headers are the most common cause, but they are not the only one. A page may redirect to a login screen, rely on third-party cookies, use JavaScript frame-busting, attempt mixed HTTP content from an HTTPS parent, or deliberately serve a different experience when framed.
The same-origin policy is being confused with iframe loading
A cross-origin iframe can often display even though the parent page cannot inspect its DOM. That restriction is the same-origin policy. It is separate from whether the browser is allowed to render the child document in the first place.
Iframe, crawler and security-policy tools
Check embedding or crawler access, then use the code, sandbox and policy tools to investigate a specific issue.
Common questions
How do I test whether a website can be embedded in an iframe?
Paste the complete page URL into the tester. IframeTester checks the final response for X-Frame-Options and Content-Security-Policy frame-ancestors, then lets you load a live preview to inspect how the browser behaves.
Why does a URL work in a browser tab but fail in an iframe?
The destination can allow normal navigation while separately blocking framing. X-Frame-Options and CSP frame-ancestors are designed specifically to control whether another page may embed the document.
Does CORS block iframes?
Usually no. CORS primarily controls script access to cross-origin responses. A cross-origin iframe can load without CORS, but the browser still enforces framing policies, mixed-content rules, cookie restrictions and the same-origin policy for DOM access.
Can this tester bypass X-Frame-Options?
No. The tester diagnoses framing restrictions. It does not bypass a third-party site's security policy. If you own the destination, change its response headers. If you do not, use an official embed, API, widget or normal link.
Is a missing X-Frame-Options header enough to prove that embedding will work?
No. CSP frame-ancestors can block framing even when X-Frame-Options is absent. JavaScript frame-busting, authentication, cookies, redirects and provider-specific behavior can also affect the final browser result.