About iframecheck
iframecheck tells you if a page can be shown inside an iframe on another site. It reads the page's headers, shows a live preview, and gives you the fix when the page is blocked.
Updated
What a check does
Our server requests the URL you enter, reads the response headers, and does not keep the page. Your browser then loads the same URL in an iframe, so the preview shows what your visitors will see.
What it reads
X-Frame-Options, the frame-ancestors rule of Content-Security-Policy, cookies and their SameSite value, and the redirects on the way to the page.
How the verdict works
The verdict follows the rules of the HTML standard. An enforced CSP frame-ancestors rule wins over X-Frame-Options. Browsers ignore ALLOW-FROM, so iframecheck ignores it too. SAMEORIGIN or a list of allowed sites gives a partial result. The server follows up to 5 redirects and reads only the headers, never the page body.
What it does not do
iframecheck has no accounts. It does not save the URLs you test or the pages it fetches to a database or a file. Its host keeps request logs for 7 days. A log line can hold the URL that you tested. It cannot reach private networks or pages that need a login.
Who runs iframecheck
Dobroslav Radosavljevič made iframecheck and runs it from the Czech Republic. If a result or a guide looks wrong, email business@dobroslavlabs.com.