Iframe Tester
Enter a URL to see it in a full-size iframe and check what may block it.
One iframe test, two different signals
A useful iframe checker needs to inspect the server response and the browser result. Either one alone can miss important failure modes.
X-Frame-Options
Detects DENY and SAMEORIGIN response headers that can prevent a page from loading inside a frame.
CSP frame-ancestors
Reads the modern Content Security Policy directive that tells browsers which parent origins may frame a page.
Browser preview
Loads the destination in a real iframe so you can catch problems that a header-only check cannot fully predict.
Test an iframe before you ship the embed
- Paste the exact URL you plan to embed. Use the final page URL when possible, including the correct HTTPS scheme.
- Add the embedding website when it matters. If the page will be framed on a specific site, enter that parent origin so SAMEORIGIN and CSP allowlists are evaluated against the real embedding context.
- Run the iframe test. The server checks the final response headers after a small number of redirects.
- Read the verdict. A DENY or SAMEORIGIN X-Frame-Options value is highlighted. CSP frame-ancestors is shown separately because it supports more precise allowlists.
- Check the live preview. A header result can say a page is likely embeddable while browser behavior still fails because of JavaScript, authentication, storage restrictions or an application-specific rule.
- Copy the result link or embed code. Only the copied result link includes the test URL. Opening that link prefills the form; select Render iframe to run it.
Important: this tool is for testing compatibility, not bypassing security controls. A destination site decides whether it may be framed.
Use the tester as an iframe viewer, too
Use Fit for a full-width view, or choose Mobile, Tablet, Desktop or Custom to inspect a specific frame size. These controls resize the iframe; they do not change the destination's framing policy.
Standard mode behaves like a normal iframe. Restricted mode adds a sandbox and removes the referrer, so a page may behave differently. If the destination blocks framing, changing the preview size will not bypass it.
Why an iframe can be blocked
X-Frame-Options blocks the page
X-Frame-Options: DENY tells the browser not to render the page in a frame at all. SAMEORIGIN permits framing only when the parent and child are from the same origin. The older ALLOW-FROM value should not be relied on in modern browsers.
CSP frame-ancestors limits the allowed parent
Content Security Policy provides a more flexible control through frame-ancestors. A page can allow itself, a specific list of trusted origins, or no parent at all. The directive is different from frame-src: frame-ancestors controls who can embed the current page, while frame-src controls what the current page may load into its own frames.
The browser has another reason to refuse the embed
Framing headers are the most common cause, but they are not the only one. A page may redirect to a login screen, rely on third-party cookies, use JavaScript frame-busting, attempt mixed HTTP content from an HTTPS parent, or deliberately serve a different experience when framed.
The same-origin policy is being confused with iframe loading
A cross-origin iframe can often display even though the parent page cannot inspect its DOM. That restriction is the same-origin policy. It is separate from whether the browser is allowed to render the child document in the first place.
More iframe testing tools
Use the main tester for URL compatibility, then move into code, sandbox and policy testing when you need a narrower answer.
Common questions
How do I test whether a website can be embedded in an iframe?
Paste the complete page URL into the tester. IframeTester checks the final response for X-Frame-Options and Content-Security-Policy frame-ancestors, then lets you load a live preview to inspect how the browser behaves.
Why does a URL work in a browser tab but fail in an iframe?
The destination can allow normal navigation while separately blocking framing. X-Frame-Options and CSP frame-ancestors are designed specifically to control whether another page may embed the document.
Does CORS block iframes?
Usually no. CORS primarily controls script access to cross-origin responses. A cross-origin iframe can load without CORS, but the browser still enforces framing policies, mixed-content rules, cookie restrictions and the same-origin policy for DOM access.
Can this tester bypass X-Frame-Options?
No. The tester diagnoses framing restrictions. It does not bypass a third-party site's security policy. If you own the destination, change its response headers. If you do not, use an official embed, API, widget or normal link.
Is a missing X-Frame-Options header enough to prove that embedding will work?
No. CSP frame-ancestors can block framing even when X-Frame-Options is absent. JavaScript frame-busting, authentication, cookies, redirects and provider-specific behavior can also affect the final browser result.