Skip to content
iframecheck

frame-ancestors

frame-ancestors is a Content-Security-Policy directive that lists the sites that may embed your page in a frame. If a parent frame is not on the list, the browser blocks the load.

CSP directive

Updated

On this page

How it works

The browser reads the directive from the response of the page that goes in the frame. It checks each frame above the page, up to the top window. If one ancestor does not match the list, the browser cancels the load.

The directive covers <iframe>, <frame>, <object>, and <embed>. It does not fall back to default-src, and it has no effect in a <meta> tag. When an enforced policy has frame-ancestors, browsers ignore X-Frame-Options.

Values

ValueWho can frame the page
'none'No site. The single quotes are necessary.
'self'Pages with the same origin.
https://partner.examplePages on that origin.
https://*.partner.examplePages on any subdomain of partner.example, but not on partner.example itself.
https:Any site on HTTPS.
*Any site.

Example

HTTP response header
Content-Security-Policy: frame-ancestors 'self' https://partner.example

Pages on your own origin and on https://partner.example may frame this page. The browser blocks the frame on all other sites.

How to set it

Send the directive in the Content-Security-Policy header of the page that goes in the frame. If you already send a policy, add the directive to it.

# Your own site and one partner
Content-Security-Policy: frame-ancestors 'self' https://partner.example

# No site at all
Content-Security-Policy: frame-ancestors 'none'

Content-Security-Policy-Report-Only only reports. It does not block the frame, and it does not switch off X-Frame-Options.

Learn more

Sources

Know before you embed.

Free, no sign-up, nothing stored. Paste a URL and get a verdict, a live preview, and the fix.

Test a URLBrowse guides