Iframe Checker

How to use the Iframe Checker (Can This Site Be Embedded?) tool

1. Paste the URL of the page you want to embed. https:// is added if you leave the scheme out.
2. Optionally type the site you want to embed it on, such as https://yoursite.com, in the Your site box. Without it you still get the answer for any other site and for the page's own origin.
3. Click Check Iframe. The tool fetches the URL from our edge, follows redirects the way a frame does, and reads X-Frame-Options and Content-Security-Policy on the final response.
4. Read the verdict and the Who can embed it rows, each with the rule that decided it. The Notes list flags problems such as ALLOW-FROM, a meta tag that browsers ignore, an http:// page or a frame-busting script.
5. Check the live preview at full, desktop, tablet or phone width, then click Copy to take the embed code, which points at the final URL. Dummy Data runs a worked example.

How to check if a page can be framed in code

# -L follows redirects and prints the headers of every hop; the last block is the one that counts
curl -sIL https://stripe.com | grep -iE "^(HTTP/|x-frame-options:|content-security-policy:)"

# Only the frame-ancestors directive
curl -sIL https://stripe.com | grep -i "^content-security-policy:" | tr ";" "\n" | grep -i frame-ancestors

// Simplified: handles 'none', 'self', * and exact or *.wildcard hosts.
// The tool also applies the CSP3 rules for schemes, ports, paths and multiple policies.
async function canFrame(url, parentOrigin) {
    const res = await fetch(url); // follows redirects
    const self = new URL(res.url).origin;
    const csp = res.headers.get("content-security-policy") ?? "";
    const fa = csp.split(";").map((d) => d.trim().split(/\s+/))
        .find(([name]) => name.toLowerCase() === "frame-ancestors");

    if (fa) {
        const parentHost = new URL(parentOrigin).hostname;
        return fa.slice(1).some((src) => {
            src = src.toLowerCase();
            if (src === "*") return true;
            if (src === "'self'") return parentOrigin === self;
            const host = src.replace(/^[a-z]+:\/\//, "").replace(/[:/].*$/, "");
            return host.startsWith("*.") ? parentHost.endsWith(host.slice(1)) : parentHost === host;
        });
    }
    const xfo = (res.headers.get("x-frame-options") ?? "").trim().toLowerCase();
    if (xfo === "deny") return false;
    if (xfo === "sameorigin") return parentOrigin === self;
    return true; // no header, or a value browsers ignore
}

console.log(await canFrame("https://stripe.com", "https://app.contentful.com")); // true
console.log(await canFrame("https://github.com", "https://example.com")); // false

import requests

def frame_headers(url):
    r = requests.get(url, timeout=10)  # follows redirects
    csp = r.headers.get("Content-Security-Policy", "")
    fa = next((d.strip() for d in csp.split(";") if d.strip().lower().startswith("frame-ancestors")), None)
    return {
        "final_url": r.url,
        "x_frame_options": r.headers.get("X-Frame-Options"),
        "frame_ancestors": fa,  # when set, browsers ignore X-Frame-Options
    }

print(frame_headers("https://github.com"))
# {'final_url': 'https://github.com/', 'x_frame_options': 'deny', 'frame_ancestors': "frame-ancestors 'none'"}

Common errors and how to fix them

Refused to display '...' in a frame because it set 'X-Frame-Options' to 'sameorigin'

The page allows only its own origin. If it is your site, replace the header with Content-Security-Policy: frame-ancestors 'self' https://yoursite.example. If it is someone else's, look for an official embed URL; nothing on the embedding page can override the header.

Refused to frame '...' because an ancestor violates the following Content Security Policy directive: "frame-ancestors ..."

Your origin is not on the list. Add it exactly as the browser sees it, scheme included: https://www.example.com and https://example.com are different origins, and https://*.example.com does not cover the bare domain.

Mixed Content: The page at 'https://...' was loaded over HTTPS, but requested an insecure frame 'http://...'

Change the iframe src to https://. A page that has no https version cannot be embedded on an https site at all, whatever its headers say.

The Content Security Policy directive 'frame-ancestors' is ignored when delivered via a <meta> element

Move the directive into the HTTP response header, through the server config, a CDN rule or framework middleware. A meta CSP supports most directives but not frame-ancestors, sandbox or report-uri.

Invalid 'X-Frame-Options' header encountered when loading '...': 'ALLOW-FROM ...' is not a recognized directive

Replace it with Content-Security-Policy: frame-ancestors https://partner.example. Until then the page has no framing protection at all, because the ignored header leaves every site free to frame it.

Good to know