Changelog
9 changes to iframecheck, newest first.
Updated
October 2026
9 changes- New
Bulk check
Paste up to 100 URLs and check them all at once. Filter the results by verdict. Copy them as CSV or JSON, or download them as CSV.
- New
Clickjacking test
Check if another site can load your page in a hidden frame. See a demo of the attack and the header that stops it.
- New
Header generator
Choose who may embed your site and get the Content-Security-Policy frame-ancestors header, with the config for Nginx, Apache, Vercel and more.
- New
Error pages, platform guides and a glossary
The exact browser messages that stop an iframe with the cause and the fix, the steps to add an iframe on website builders, and plain definitions of iframe terms.
- New
Sandbox playground
Turn each sandbox flag and permission on or off, watch the page react, and copy the finished iframe tag.
- New
Sites directory
Live iframe checks of popular services such as YouTube, Google Docs and Figma, with the embed method from the official docs of each one.
- New
Responsive preview
See one embed on a phone, a tablet and a laptop side by side, or add a desktop.
- Improved
A clear verdict for every page
Each check now reads X-Frame-Options, CSP frame-ancestors and cookies, and says in one sentence why the page can or cannot be embedded.
- New
Fix guides for eight servers
Copy-ready config to allow embedding on Nginx, Apache, Vercel, Netlify, Cloudflare, Next.js, Express and WordPress.