How the check works
Before a browser shows a page inside an <iframe>, it reads two headers the page sent back. The checker fetches the page the way a browser loading a frame does, follows any redirects to where you would really land, and applies the same rules:
| The page sends | In a frame on another site |
|---|---|
Nothing sent | Loads |
X-Frame-Options: DENY | Blank |
X-Frame-Options: SAMEORIGIN | Blank — only the site’s own pages may frame it |
X-Frame-Options: ALLOW-FROM … | Ignored by current browsers, so it loads |
frame-ancestors 'none' | Blank |
frame-ancestors 'self' | Blank — only the site’s own pages may frame it |
frame-ancestors https://a.com | Loads on a.com, blank everywhere else |
frame-ancestors * | Loads everywhere |
When a page sends both, frame-ancestors wins and X-Frame-Options is ignored entirely. A policy sent as Report-Only only reports; it blocks nothing.
Why so many sites say no
The headers exist because of clickjacking: a page frames your bank invisibly, lays a harmless-looking button over its “transfer” button, and lets you do the clicking. So anything with a sign-in, a payment or a settings page blocks framing by default — GitHub, Google, Apple, most banks and most web apps.
The sites that want to be everywhere — video, maps, music, design files — keep their main pages locked and publish a separate page built to be embedded. The iframe generator finds it for you.
Allowed doesn’t always mean it works
A page can permit framing and still show up empty or signed out. Safari blocks the cookies a framed site would use to recognise you, and Firefox gives every framed site a separate cookie jar, so anything behind a login usually shows its sign-in screen instead. Some pages also run a script that tries to break out of any frame they are put in.
How to show a site that refuses
You can’t switch the header off from the outside — it’s the site’s decision, and the browser enforces it. That leaves three honest options:
- Use its embed page, if it has one: YouTube, Vimeo, Twitch, Spotify, Google Maps, Figma and Loom all do.
- Ask the owner to add your site to their
frame-ancestorslist. - Don’t use a frame at all. Tabula puts every website on one canvas as its own page, not a frame, so these headers never apply — GitHub, Gmail and Google Docs sit side by side, signed in like any other tab. What a spatial browser is.
For site owners: allow or block framing
Send one Content-Security-Policy header. Pick the line that matches what you want:
# Nobody may frame this site
Content-Security-Policy: frame-ancestors 'none'
# Only your own pages, plus one partner
Content-Security-Policy: frame-ancestors 'self' https://partner.example
# Anyone may frame it
Content-Security-Policy: frame-ancestors *Sending X-Frame-Options: DENY as well only matters for very old browsers; every current one follows frame-ancestors. Run your site through the checker afterwards to confirm the header is live.
Questions
Why does my iframe say the website refused to connect?
That is the message Chrome shows when a page forbids framing, with an X-Frame-Options header of DENY or SAMEORIGIN or a Content-Security-Policy frame-ancestors rule that leaves your site out. The page loaded fine; the browser simply refused to show it inside your frame.
What does X-Frame-Options SAMEORIGIN mean?
Only pages on the same site may show it in a frame. google.com sends SAMEORIGIN, so Google can frame its own pages, but any other site gets a blank frame.
Can I embed YouTube, Google Maps or X?
YouTube and Google Maps both refuse to be framed on their main sites but publish embed pages that are made for it — the iframe generator turns an ordinary YouTube or Maps link into one. x.com only allows its own domains to frame it; single posts can be embedded with the embed code X provides.
Is there a way to get around X-Frame-Options?
Not from the page doing the embedding — the browser enforces the header for the site that sent it. Proxies that strip the header break sign-ins and often a site’s terms. The dependable way to see such a site next to others is a browser that does not use frames at all.
How accurate is this check?
It sends the same kind of request a browser sends when it loads a frame, follows redirects, and applies the rules browsers apply. It cannot see scripts that break out of frames, or pages that change once you sign in, and a few sites answer automated requests differently from browsers — the result says so when that looks likely.