Embeddable on some sites only

x.com · 200 OK · 200 ms

Only these sites may embed it: 'self', https://x.com, https://x.com:443, https://twitter.com, https://twitter.com:443.

X-Frame-Options

SAMEORIGIN (ignored)

CSP frame-ancestors

'self' https://x.com https://x.com:443 https://twitter.com https://twitter.com:443

4 set · SameSite: Lax, None

Response

200 OK · 200 ms · HTTPS

Own this site?

Allow framing in two lines

Remove X-Frame-Options and list the sites that may embed you in frame-ancestors. Pick your server to get the config.

location / {
  proxy_hide_header X-Frame-Options;
  add_header Content-Security-Policy "frame-ancestors 'self' https://your-site.com" always;
}

nginx.confReplace your-site.com with the site that embeds this page.

375 × 667

x.com refused to connect.

Only the sites in its list may embed it. Other visitors see this.