IframeTester for Developers
Share repeatable checks in bug reports and documentation. Deployments can also opt in to a tightly rate-limited JSON endpoint for low-volume automation.
Share a repeatable iframe test
The homepage accepts a url query parameter and an optional parent origin. The link prefills the form so a teammate can click Test iframe to run the same framing-policy check without IframeTester publishing the remote page body.
https://iframetester.net/?url=https%3A%2F%2Fexample.com&parent=https%3A%2F%2Fmysite.com
Beta JSON endpoint
For security, cross-origin API access is disabled by default. External server-to-server access requires an enabled deployment and a secret API key sent as an Authorization: Bearer header. Never put that key in browser code. CORS is disabled. Website requests have the same global work limits; Origin and Referer checks are browser protections, not authentication.
GET https://iframetester.net/api/check/?url=https%3A%2F%2Fexample.com&parent=https%3A%2F%2Fmysite.com
Fresh diagnostics
Results may be cached briefly to reduce repeated outbound checks. After changing framing headers, pass fresh=1 or use the Fresh recheck button in the interface.
GET /api/check/?url=https%3A%2F%2Fexample.com&fresh=1
Example response
{
"requestedUrl": "https://example.com/",
"finalUrl": "https://example.com/",
"testedParentOrigin": "https://mysite.com",
"status": 200,
"xFrameOptions": null,
"frameAncestors": null,
"verdict": "likely-embeddable",
"reason": "No framing header was detected that blocks https://mysite.com.",
"checkedAt": "2026-09-27T00:00:00.000Z",
"fromCache": false
}Rate limits and responsible use
The application enforces burst, hourly and global quotas, bounded request durations and a concurrency cap. Distributed deployments require a shared Redis rate limiter; an explicitly configured single-process server may use memory limits. Requests fail closed when production rate limiting is unconfigured or unavailable. A reverse proxy or edge service must also limit incoming traffic. The external API is intended for small checks and documentation examples, not bulk crawling.
Request security
The checker accepts only HTTP and HTTPS URLs. It rejects credentials, localhost, private or reserved IP ranges, metadata targets and direct IP targets. Each hostname is resolved and validated before the outbound connection, and the request is pinned to that validated public IP so a second DNS lookup cannot redirect the connection to a private address. Redirect destinations are resolved and validated again.
What the endpoint can and cannot prove
The endpoint can inspect status codes, redirects and framing-related response headers. It cannot fully simulate every browser condition. JavaScript frame-busting, authentication, cookie policy, referrer requirements and application logic can still make the browser result differ from the header verdict. Use the live preview when final rendering matters.