X-Frame-Options & frame-ancestors Explainer
Paste X-Frame-Options and/or a CSP frame-ancestors directive to see who is allowed to embed the page, and test a few attacker origins.
Would this be framed?
Pick a parent page (or type any origin). Tooltern applies the modern browser rule: if frame-ancestors is present it wins over X-Frame-Options; otherwise XFO decides. A sandboxed iframe does not bypass these checks.
How it works
Paste an X-Frame-Options header, a Content-Security-Policy that includes frame-ancestors, both together, or a whole response-header dump from DevTools / curl -I. The tool picks out the framing rules and explains each value in plain words.
X-Frame-Options understands DENY (nobody), SAMEORIGIN (exact scheme + host + port only — not subdomains) and the deprecated ALLOW-FROM URI. Chromium, Firefox and Safari ignore ALLOW-FROM, which is why a header that looks protective can still leave you open to clickjacking.
CSP frame-ancestors is the modern replacement: 'none', 'self', host names, wildcards like *.partner.example and schemes. It is not covered by default-src, and a <meta http-equiv> CSP cannot set it — only an HTTP header counts. When both XFO and frame-ancestors are present, modern browsers obey frame-ancestors and ignore XFO for framing.
Would this be framed? tests parents such as the same origin, https://example.com, https://evil.example, a sibling subdomain, or a sandboxed / null origin. A sandboxed iframe does not bypass these checks. For the console error itself, see Refused to display in a frame because an ancestor violates…. For a full CSP (scripts, images, hashes), use the CSP header explainer. Need the same grade and framing check in a script or CI job? Anvil's free clickjacking header API returns the findings as JSON, no key needed.
Questions
What does X-Frame-Options: DENY mean?
The page may not be shown inside any frame or iframe, not even on the same site. Use it when the page should never be embedded.
SAMEORIGIN vs frame-ancestors 'self'?
Same idea for simple sites: only the exact origin may embed the page. Prefer frame-ancestors, which can also allow specific partners and is the header modern browsers prioritise.
Why does ALLOW-FROM not work in Chrome?
ALLOW-FROM was never implemented in Chromium and is ignored there (and in Firefox/Safari). Use Content-Security-Policy: frame-ancestors https://partner.example instead.
Can I set frame-ancestors in a meta tag?
No. Browsers ignore frame-ancestors, report-uri and sandbox when the policy comes from a meta tag. Send them as an HTTP response header.
Does a sandboxed iframe bypass DENY?
No. Sandbox changes what the framed page can do; it does not let a blocked parent embed it. Opaque / null parents also fail 'self' and host matches.
Is my header uploaded?
No. Parsing and the framing simulation run entirely in your browser, and nothing is stored. The same checks are also available as a keyless JSON API at api.oddlathe.com/v1/frame/check if you need them from a script.