Skip to content
iframecheck

“example.com refused to connect.” in an iframe

Chrome and Edge show “refused to connect.” inside a frame that a header blocks. The server answered. X-Frame-Options or CSP frame-ancestors does not allow your site, and only the owner of the page can change that.

  • Chrome
  • Edge
  • Firefox
  • Safari

Updated

Text in the frame · Chrome and Edge, exact text

example.com refused to connect.

Chrome, EdgeExact text

The frame shows a gray page: “example.com refused to connect.”

Refused to display 'https://example.com/' in a frame because it set 'X-Frame-Options' to 'sameorigin'.

FirefoxExact text

The frame shows “Firefox Can’t Open This Page”.

SafariWhat you see

The frame stays blank. There is no message in the page.

On this page

What it means

Chrome and Edge show this text inside the frame, with the host of the page you embed. The server did not refuse anything: it sent the page with a header that forbids your site. Open the page in a new tab. If it loads there, a framing header is the cause. Test the URL to see which one.

Why it happens

The name is misleading. The connection worked, and the server sent the page. The browser read a header and did not show the page in the frame:

  1. X-Frame-Options with DENY or SAMEORIGIN.

  2. CSP frame-ancestors that does not list your site.

  3. The error code under the text is net::ERR_BLOCKED_BY_RESPONSE. The console line above the frame names the header.

Check the page

See the headers the page sends now

Fix it if you own the site

Open the console and read the line that names the header. Then remove X-Frame-Options and list each site that may embed the page in frame-ancestors. Pick your server. The guide Find the header that blocks your iframe matches each message to its header.

location / {
  proxy_hide_header X-Frame-Options;
  add_header Content-Security-Policy "frame-ancestors 'self' https://your-site.com" always;
}
nginx.confReplace your-site.com with the site that embeds this page.

Do not use X-Frame-Options ALLOW-FROM. Modern browsers ignore it. Do not add * to frame-ancestors unless any site may embed the page.

If you do not own the site

You cannot remove the header from your side. No iframe attribute or proxy trick is a safe fix. Use one of these.

  1. Use the official embed URL

    YouTube, Google Maps, Calendly, and others give a special embed link that allows frames.

  2. Link out instead

    Open the page in a new tab with a normal link, or show a preview card that links to it.

  3. Ask the owner

    Ask them to add your site to frame-ancestors. Send them this page.

Sources

Know before you embed.

Free, no sign-up, nothing stored. Paste a URL and get a verdict, a live preview, and the fix.

Test a URLBrowse guides