Skip to content
iframecheck

Frame busting

Frame busting is a JavaScript method that tries to stop a page from showing in a frame. The script checks if the page is the top window. If not, it sends the top window to the URL of the page.

Concept

Also called Frame breaking, Framebuster

Updated

On this page

How it works

The script compares self with top. If they are not the same window, the page is in a frame. The script then sets top.location to the address of the page, so the page fills the whole tab.

Sites used frame busting against clickjacking before browsers had X-Frame-Options and CSP frame-ancestors. OWASP now calls these scripts unreliable. It tells you to send the headers and to use a script only as an extra step.

Why it fails

  • Sandboxed frames. The parent page can add the sandbox attribute to the iframe. Without allow-scripts, the script does not run. Without allow-top-navigation, it cannot move the top window.
  • Browser limits. A cross-origin frame can move the top window only after the visitor interacts with the frame or allows the move. MDN calls this the framebusting intervention.
  • Blocked navigation. The parent page can stop the move with an onbeforeunload prompt or with 204 No Content responses.
  • Double framing. When the page sits in a frame inside another frame, the browser can block the move to the top window.

Send Content-Security-Policy: frame-ancestors and X-Frame-Options instead. The browser applies them before the page loads, so no script needs to run.

Example

HTML (legacy script)
<style id="anti-clickjack">body { display: none !important; }</style>
<script>
  if (self === top) {
    document.getElementById("anti-clickjack").remove();
  } else {
    top.location = self.location;
  }
</script>

The page stays hidden until the script finds that it is the top window. OWASP shows this pattern only for old browsers.

Learn more

Sources

Know before you embed.

Free, no sign-up, nothing stored. Paste a URL and get a verdict, a live preview, and the fix.

Test a URLBrowse guides