X-Frame-Options Checker
Check if any website has clickjacking protection by inspecting the X-Frame-Options HTTP header. Enter a URL to perform a live header check and detect DENY, SAMEORIGIN, or ALLOW-FROM directives, or paste an X-Frame-Options value directly to analyse its security implications. Get a detailed security rating with browser support information and actionable recommendations - no signup required.
Check if a website sets the X-Frame-Options header for clickjacking protection, or analyse an X-Frame-Options header value directly. Enter a URL to perform a live header check, or paste a header value (DENY, SAMEORIGIN, ALLOW-FROM) for analysis.
Enter a URL to check its X-Frame-Options header. https:// is added automatically if missing.
Why Use Our X-Frame-Options Checker?
Live URL Header Inspection
Check any website's X-Frame-Options header in real time. Enter a URL and our tool sends a HEAD request to fetch the response headers, revealing whether the site has clickjacking protection configured. Quick-test buttons for popular sites make it easy to compare security postures.
Header Value Analysis
Analyse any X-Frame-Options header value - DENY, SAMEORIGIN, or ALLOW-FROM - and get a detailed security rating with a plain-English explanation. Understand exactly what each directive means for your site's framability and clickjacking protection.
Browser Support Matrix
Every X-Frame-Options directive includes a browser support note. See at a glance which browsers support DENY, SAMEORIGIN, and the legacy ALLOW-FROM directive. Know when to use CSP frame-ancestors as a modern alternative for broader browser coverage.
CSP frame-ancestors Detection
Automatically detect Content-Security-Policy frame-ancestors directives when checking a URL. If the site uses CSP for clickjacking protection alongside or instead of X-Frame-Options, our tool highlights it and shows the allowed ancestor origins.
Common Use Cases for X-Frame-Options Checker
Security Audit & Clickjacking Prevention
Use the X-Frame-Options checker to audit your website's clickjacking protection. Verify that your site sets DENY or SAMEORIGIN to prevent malicious sites from embedding your pages in iframes. Essential for PCI DSS and security compliance requirements.
Third-Party Integration Testing
When integrating third-party services that embed your site in iframes (payment gateways, SSO providers, embedded dashboards), use this tool to verify that your X-Frame-Options settings allow the required embedding without compromising security.
Web Development & Debugging
If your site fails to render inside an iframe during development, check the X-Frame-Options header to identify whether the server is blocking embedding. Determine whether to use SAMEORIGIN, ALLOW-FROM, or CSP frame-ancestors for your use case.
Competitor Security Analysis
Check what X-Frame-Options policies your competitors use. Understand industry standards for clickjacking protection and compare your security posture against similar websites in your sector.
HTTPS & Security Header Compliance
As part of a comprehensive security header audit, use this tool to verify X-Frame-Options is properly configured alongside HSTS, CSP, and other security headers. Ensure your site meets OWASP security recommendations.
Legacy Browser Support Planning
When supporting older browsers like Safari 5+ or IE 9+, use the browser support information in our tool to decide between X-Frame-Options ALLOW-FROM and modern CSP frame-ancestors for your clickjacking protection strategy.
Understanding X-Frame-Options
What is X-Frame-Options?
X-Frame-Options is an HTTP response header that controls whether a browser is allowed to render a page in a <frame>,<iframe>, <embed>, or<object> element. It is the primary defence againstclickjacking attacks, where an attacker embeds a legitimate site inside an invisible iframe and tricks users into clicking elements they cannot see. The header supports three directives: DENY (block all framing),SAMEORIGIN (allow same-origin framing only), and the legacyALLOW-FROM (allow a specific origin - limited browser support).
How Our X-Frame-Options Checker Works
- Choose a mode:Select "Check URL" to inspect a live website's X-Frame-Options header, or "Analyse Header Value" to evaluate a specific header value (DENY, SAMEORIGIN, ALLOW-FROM).
- Enter input:For URL mode, type a URL and click "Check URL". Your browser sends a HEAD request to the target server and captures the response headers. For value mode, paste an X-Frame-Options value directly.
- Review analysis: Our tool analyses the X-Frame-Options setting and provides a security rating (secure, moderate, insecure, or invalid). You get a plain-English explanation, browser support information, and specific recommendations for improving your clickjacking protection.
X-Frame-Options vs CSP frame-ancestors
While X-Frame-Options is widely supported, it has limitations. TheALLOW-FROM directive is not supported in Chrome, Firefox, or Edge, making it unreliable for cross-browser protection. The modern alternative is theContent-Security-Policy (CSP) frame-ancestors directive, which offers more granular control:
- frame-ancestors 'none' - Equivalent to X-Frame-Options: DENY
- frame-ancestors 'self' - Equivalent to X-Frame-Options: SAMEORIGIN
- frame-ancestors example.com - Supports multiple origins (unlike ALLOW-FROM)
When both X-Frame-Options and CSP frame-ancestors are present, modern browsers honour the more restrictive policy. CSP frame-ancestors is supported in all modern browsers and is recommended over ALLOW-FROM for new deployments.
Privacy, Security & Availability
Our X-Frame-Options Checker sends requests directly from your browser to the target server. We do not proxy, store, log, or process any URL checks on our servers. The tool is 100% free with no signup, no account, and no usage limits. All header parsing and security analysis happens client-side in your browser. Note that some servers may block HEAD requests or have CORS restrictions, which may cause certain URLs to fail. For those cases, use the "Analyse Header Value" mode by pasting the header value directly.
Related Tools
DMARC Record Checker
Check DMARC records for any domain via Cloudflare DNS-over-HTTPS. Validate email authentication policy (none/quarantine/reject), analyse alignment settings (adkim, aspf), and extract reporting addresses (rua, ruf) - free online DMARC record checker.
DNS Leak Test
Check if DNS queries and WebRTC are leaking your real IP outside your VPN tunnel. Detects local IPs via WebRTC STUN requests, checks public IP and geolocation via free APIs, and identifies DNS resolvers - free online DNS leak test.
DNS Record Comparator
Compare DNS records across Cloudflare, Google, and Quad9 nameservers automatically. Detects differences in A, MX, NS, CNAME, TXT, AAAA, and SOA records with severity indicators - free online DNS comparison tool.
Reverse DNS Lookup
Look up PTR records for any IPv4 or IPv6 address via Cloudflare DNS-over-HTTPS. Instantly find the hostname behind any IP address with DNSSEC validation status and query time - free online reverse DNS lookup tool.
Frequently Asked Questions About X-Frame-Options Checker
X-Frame-Options is an HTTP response header that controls whether a page can be displayed in an iframe, frame, embed, or object element. It is important because it protects against clickjacking attacks, where an attacker tricks users into clicking hidden elements on a legitimate site embedded within an invisible iframe. Without X-Frame-Options, any website can embed your pages, potentially leading to credential theft, unauthorized actions, and data breaches.
DENY blocks all framing attempts - your page cannot be displayed in an iframe on any site, including your own. This is the most secure option. SAMEORIGIN blocks framing from external sites but allows it when the page is framed by another page on the same origin. Choose DENY if you never need to frame your content. Choose SAMEORIGIN if you need to embed your own pages (e.g., for widgets, admin panels, or same-site embeds).
No. ALLOW-FROM is only supported in Safari 5+ and Internet Explorer 9+. It is NOT supported in Chrome, Firefox, or Edge. Because of this limited browser support, the W3C recommends using the Content-Security-Policy frame-ancestors directive instead. If you need to allow framing from specific origins, use CSP frame-ancestors for comprehensive browser coverage.
CSP frame-ancestors is the modern replacement for X-Frame-Options. It supports multiple origins (e.g., frame-ancestors example.com trustedsite.com), works with CSP reporting (report-uri/report-to), and is supported in all modern browsers. When both headers are present, browsers enforce the more restrictive policy. Unlike X-Frame-Options which only has DENY, SAMEORIGIN, and ALLOW-FROM, CSP frame-ancestors allows wildcards, scheme sources, and multiple specific origins for granular control.
Yes, you can use both. When both headers are present, most browsers enforce the more restrictive policy. This dual-header approach is useful during migration from X-Frame-Options to CSP frame-ancestors. However, note that X-Frame-Options is ignored if CSP frame-ancestors is present in Chrome and Firefox. For maximum compatibility, include both during the transition period.
Absolutely. The X-Frame-Options Checker sends requests directly from your browser to the target server. We do not proxy, store, log, or process any URL checks on our servers. All header analysis happens client-side in your browser. The tool is 100% free with no signup or account required.
Some servers may block HEAD requests, require authentication, or have CORS restrictions that prevent browser-side fetching. If the server is down or unreachable, the check will fail. Try checking the URL in a regular browser window first to confirm it is accessible. If you cannot fetch headers from a URL, use the "Analyse Header Value" mode to paste the X-Frame-Options value directly.
The rating reflects the effectiveness of the X-Frame-Options setting: Secure (DENY or SAMEORIGIN properly configured), Moderate (ALLOW-FROM - works but has limited browser support), Insecure (no X-Frame-Options header found - vulnerable to clickjacking), and Invalid (the header value is not recognised or malformed). Each rating includes a specific recommendation for improvement.