X-Frame-Options · CSP frame-ancestors · live preview

Can this page live inside an <iframe>?

Paste a URL. See instantly whether it can be embedded, the exact header that decides it, and how it looks at any screen size.

Try

Reference

How iframe embedding works

Everything the result card is based on, in plain language.

What does iframetester.dev do?

It tells you whether a web page can be embedded in an <iframe> on another site, and why. We fetch the page from our server, read the headers that control framing, and show a live preview at the screen size you pick.

What decides whether a page can be iframed?

Two response headers, sent by the embedded page’s server:

  • Content-Security-Policy: frame-ancestors …, the modern control. It lists which sites may embed the page: 'none' (nobody), 'self' (only the same origin), specific hosts like https://partner.com, or * (anyone).
  • X-Frame-Options, the older control: DENY (nobody) or SAMEORIGIN (same origin only).

If a page sends frame-ancestors, browsers ignore X-Frame-Options entirely. If it sends neither, anyone can embed it.

Does X-Frame-Options ALLOW-FROM still work?

No. ALLOW-FROM was never supported by Chrome or Safari and has been dropped by Firefox too. Browsers ignore it, which means the page ends up embeddable by everyone. To allow specific sites, use Content-Security-Policy: frame-ancestors https://your-site.com.

How do I allow or block embedding of my own site?

Send a frame-ancestors directive in your Content-Security-Policy response header:

# nobody may embed
Content-Security-Policy: frame-ancestors 'none'

# only your own pages
Content-Security-Policy: frame-ancestors 'self'

# your pages plus one partner
Content-Security-Policy: frame-ancestors 'self' https://partner.com

For very old browsers you can also send X-Frame-Options: DENY or SAMEORIGIN. Note that frame-ancestors only works as an HTTP header, not in a <meta> tag.

Why is the preview blank or showing “refused to connect”?

That is the browser enforcing one of the headers above. Your result card shows which header is responsible. Other causes are an http:// page inside an https:// site (blocked as mixed content), or a page that fails to load at all.

The verdict says allowed, but the page still misbehaves in the frame. Why?

Embeddable doesn’t mean fully functional. Inside an iframe, most browsers partition or block third-party cookies and storage, so logins and sessions often fail. Some sites also use JavaScript to detect framing and redirect or hide themselves. Test the full flow, not only the first page.

Can I test a site running on localhost?

Yes. Enter something like localhost:3000. Our server can’t reach your machine, so the header check is skipped, but the preview is loaded by your own browser and shows exactly how the page behaves when embedded.

Is the embedded page stored or copied?

No. The preview loads directly from the original site in your browser. Our server only reads the page’s response headers to explain the result. All content belongs to its owners. If you run a site and don’t want it embedded anywhere, send Content-Security-Policy: frame-ancestors 'none'.