X-Frame-Options Checker
Check X-Frame-Options and CSP frame-ancestors for a public URL.
Read the destination's iframe policy before changing your code
When a page works in a normal tab but fails inside an iframe, inspect the destination response before rewriting your HTML. The parent page cannot grant framing permission on behalf of the child site.
X-Frame-Options: DENY
The document should not be displayed in a frame. If you own the destination, change the server response only after deciding which parent origins should be trusted.
X-Frame-Options: SAMEORIGIN
The document may be framed only by a parent from the same origin. Same origin is stricter than simply sharing a registrable domain.
CSP frame-ancestors
This is the modern and more expressive control. It can allow specific HTTPS origins, 'self', or block all parents with 'none'. Unlike many CSP fetch directives, frame-ancestors does not inherit from default-src.
No framing header found
That is encouraging, not conclusive. Redirects, authentication, JavaScript frame-busting, mixed content and browser storage rules can still affect the live embed. Use the main iframe tester when you also want a browser preview.
Technical references
Check the exact page and embedding origin
Test the URL used in your iframe src, rather than only the site's homepage. A public page, login screen and provider embed endpoint can return different framing headers. Add the parent origin, including scheme and port, when evaluating SAMEORIGIN or a CSP allowlist.
The optional parent is used for policy evaluation. It does not move this preview onto that website or reproduce a chain of nested frames. For nested embeds, browsers check all ancestor origins against frame-ancestors; verify the complete chain in the real parent application.
Which framing header takes precedence?
In supporting modern browsers, an enforced CSP frame-ancestors directive takes precedence over X-Frame-Options. A report-only policy does not grant framing permission. If several enforced CSP policies are returned, the document must satisfy all of them. Test your supported browsers before removing a compatibility header.
Common questions
What values can X-Frame-Options use today?
The interoperable values are DENY and SAMEORIGIN. ALLOW-FROM is obsolete and is not a reliable modern allowlist mechanism.
Which wins, X-Frame-Options or CSP frame-ancestors?
An enforced CSP frame-ancestors directive takes precedence over X-Frame-Options in supporting modern browsers. Inspect both headers, review any additional policies and test the actual embedding context.
What does SAMEORIGIN mean?
The page is intended to be framed only by a parent with the same origin. Origin includes scheme, hostname and port, so a different subdomain or protocol is not automatically the same origin.
Can I fix another website's X-Frame-Options from my parent page?
No. The restriction comes from the framed site's response. If you do not control that site, use an authorized embed, API, widget or normal link instead.