X-Frame-Options
The original anti-clickjacking header. A server adds it to a response to tell the browser whether that document may be rendered inside a <frame>, <iframe>, <embed> or <object>.
DENYNever framed, not even by the same site.
SAMEORIGINOnly framed by pages on the same origin.
ALLOW-FROM uriObsolete. Ignored by modern browsers — use CSP instead.
HTTP/2 200
X-Frame-Options: SAMEORIGINContent-Security-Policy: frame-ancestors
The modern replacement. It supports a list of allowed parent origins, wildcards and schemes. When both headers are present, browsers that support frame-ancestors ignore X-Frame-Options.
Content-Security-Policy: frame-ancestors 'self' https://*.partner.comContent-Security-Policy: frame-ancestors 'none'Note the mirror-image directive: frame-src on your page controls which URLs you may embed. If your embed works on Iframe Viewer but not on your site, check your own CSP first.
Sandbox flags
An empty sandbox attribute removes every capability. Add tokens back one at a time.
| Token | Grants |
|---|---|
| allow-scripts | Let the framed page run JavaScript. |
| allow-same-origin | Keep the page's origin (cookies, storage). Combined with scripts this defeats the sandbox for same-origin content. |
| allow-forms | Allow form submission. |
| allow-popups | Allow window.open and target=_blank. |
| allow-popups-to-escape-sandbox | Opened windows are not sandboxed. |
| allow-modals | alert(), confirm(), prompt(), print(). |
| allow-top-navigation | Allow the frame to navigate your page. |
| allow-top-navigation-by-user-activation | Top navigation only after a click/tap. |
| allow-downloads | Allow file downloads initiated by the frame. |
| allow-presentation | Presentation API (casting). |
| allow-pointer-lock | Pointer Lock API (games). |
| allow-orientation-lock | Screen Orientation lock. |
Permissions Policy (allow)
Where sandbox removes capabilities, allow delegates powerful features to the frame. Each entry is a feature name optionally followed by an allowlist.
<iframe
src="https://player.example.com/v/123"
allow="fullscreen; autoplay; picture-in-picture; clipboard-write"
allowfullscreen
></iframe>Which sites allow framing?
The database the tester uses. Observed values — they can change without notice; confirm with the curl snippet before shipping.
| Domain | Framing | Header / alternative |
|---|---|---|
| google.com | Blocked | X-Frame-Options: SAMEORIGINGoogle Maps and YouTube expose dedicated /embed endpoints instead. |
| youtube.com | Blocked | X-Frame-Options: SAMEORIGINUse https://www.youtube.com/embed/VIDEO_ID for embedding. |
| facebook.com | Blocked | X-Frame-Options: DENYUse the official Facebook Page/Post plugins. |
| instagram.com | Blocked | X-Frame-Options: SAMEORIGINUse instagram.com/p/ID/embed/ for public posts. |
| twitter.com | Blocked | X-Frame-Options: DENYUse publish.twitter.com to get a widget snippet. |
| x.com | Blocked | X-Frame-Options: DENYUse publish.twitter.com to get a widget snippet. |
| linkedin.com | Blocked | X-Frame-Options: SAMEORIGIN |
| github.com | Blocked | X-Frame-Options: DENYGists can be embedded via the script snippet on each gist. |
| amazon.com | Blocked | X-Frame-Options: SAMEORIGIN |
| netflix.com | Blocked | X-Frame-Options: DENY |
| reddit.com | Blocked | content-security-policy: frame-ancestors 'self'Use embed.reddit.com for individual posts. |
| stackoverflow.com | Blocked | X-Frame-Options: SAMEORIGIN |
| paypal.com | Blocked | X-Frame-Options: SAMEORIGIN |
| apple.com | Blocked | X-Frame-Options: SAMEORIGIN |
| microsoft.com | Blocked | X-Frame-Options: SAMEORIGIN |
| openai.com | Blocked | content-security-policy: frame-ancestors 'none' |
| chatgpt.com | Blocked | content-security-policy: frame-ancestors 'none' |
| notion.so | Blocked | X-Frame-Options: SAMEORIGINPublic pages can be embedded via notion.site links in some tools. |
| figma.com | Blocked | X-Frame-Options: SAMEORIGINUse the /embed?embed_host=... URL from Share → Get embed code. |
| wikipedia.org | Allowed | (no framing restriction)Wikipedia allows framing. |
| example.com | Allowed | (no framing restriction) |
| codepen.io | Allowed | (embeds allowed via /embed/ URLs)Use the Embed button on a pen for the canonical snippet. |
| vimeo.com | Blocked | X-Frame-Options: SAMEORIGINUse https://player.vimeo.com/video/ID. |
| player.vimeo.com | Allowed | (embed endpoint) |
| open.spotify.com | Blocked | X-Frame-Options: SAMEORIGINUse https://open.spotify.com/embed/... URLs. |
| maps.google.com | Blocked | X-Frame-Options: SAMEORIGINUse the Share → Embed a map snippet. |
FAQ
Why does the iframe show up blank or say “refused to connect”?
The site sent an X-Frame-Options header (DENY or SAMEORIGIN) or a Content-Security-Policy with a frame-ancestors directive that doesn't include your origin. Browsers honour that and render an error page instead. The exact header is visible in DevTools → Console, or via the curl command Iframe Viewer gives you.
How do I test if a website can be embedded in an iframe?
Paste the URL into the iframe tester above and press Render. Iframe Viewer loads it in a real iframe at your chosen device size and reports whether the load succeeded, which signal decided the result, and how long it took.
Can Iframe Viewer read the X-Frame-Options header directly?
Not from the browser alone — cross-origin response headers are hidden from JavaScript by design. Iframe Viewer combines deterministic checks (mixed content, a curated database of popular sites), the browser's load event and a same-origin probe, and always tells you which signal produced the verdict. Use the curl one-liner for ground truth.
The tester says “Load event fired” but I still see an error page. Which is right?
Both. Chrome and Firefox fire load even when they substitute an error page, so the event alone can't distinguish success from a block. Trust your eyes for the final call and use the curl command to confirm.
Does Iframe Viewer store or log the URLs I test?
No. There is no server. Your history is saved in your browser's localStorage so it survives refreshes, and you can clear it with one click. Analytics, if you accept them, only count page views and button clicks — never the URLs you test.
What's the difference between allow and sandbox?
sandbox removes capabilities (scripts, forms, popups, navigation) and you add back only what you need. allow is the Permissions Policy for powerful features like camera, fullscreen or payment. Use both for third-party content you don't control.
Why does my embed work here but not on my site?
Common causes: your page is HTTPS and the target is HTTP (mixed content), the target checks the Referer header, or your own site's Content-Security-Policy has a frame-src directive that doesn't include the target. Try the referrer-policy option in Frame options.
Is Iframe Viewer really free?
Yes — completely free, no account, no limits. It's a static site with no server costs to recover.