X-Frame-Options Checker
Inspect a page's framing headers and see whether X-Frame-Options or CSP frame-ancestors is likely to block iframe embedding.
Read the destination's iframe policy before changing your code
When a page works in a normal tab but fails inside an iframe, inspect the destination response before rewriting your HTML. The parent page cannot grant framing permission on behalf of the child site.
X-Frame-Options: DENY
The document should not be displayed in a frame. If you own the destination, change the server response only after deciding which parent origins should be trusted.
X-Frame-Options: SAMEORIGIN
The document may be framed only by a parent from the same origin. Same origin is stricter than simply sharing a registrable domain.
CSP frame-ancestors
This is the modern and more expressive control. It can allow specific HTTPS origins, 'self', or block all parents with 'none'. Unlike many CSP fetch directives, frame-ancestors does not inherit from default-src.
No framing header found
That is encouraging, not conclusive. Redirects, authentication, JavaScript frame-busting, mixed content and browser storage rules can still affect the live embed. Use the main iframe tester when you also want a browser preview.
Technical references
Common questions
What values can X-Frame-Options use today?
The interoperable values are DENY and SAMEORIGIN. ALLOW-FROM is obsolete and is not a reliable modern allowlist mechanism.
Which wins, X-Frame-Options or CSP frame-ancestors?
Modern browsers support CSP frame-ancestors as the more flexible framing control. Real behavior can depend on the browser and policy combination, so inspect both and test the actual embedding context.
What does SAMEORIGIN mean?
The page is intended to be framed only by a parent with the same origin. Origin includes scheme, hostname and port, so a different subdomain or protocol is not automatically the same origin.
Can I fix another website's X-Frame-Options from my parent page?
No. The restriction comes from the framed site's response. If you do not control that site, use an authorized embed, API, widget or normal link instead.