Skip to content
iframecheck

X-Frame-Options

X-Frame-Options is an HTTP response header that controls if a page can load in a frame. It has two valid values, DENY and SAMEORIGIN, and it cannot name other sites.

HTTP header

Also called XFO

Updated

On this page

How it works

The browser reads the header from the response of the page that goes in the frame. DENY blocks every frame. SAMEORIGIN allows the frame only when each frame above the page has the same origin as the page.

The HTML standard defines the header. Its rules replace RFC 7034. If an enforced CSP has a frame-ancestors directive, the browser ignores X-Frame-Options. The value is not case-sensitive.

Values

Header valueResult
DENYNo page can frame this page, not even a page on the same origin.
SAMEORIGINOnly pages on the same origin can frame it.
ALLOW-FROM https://partner.exampleNot valid. The browser acts as if the header is not there, so any site can frame the page.
SAMEORIGIN, DENYBlocked. Two different values that include DENY or SAMEORIGIN block the frame.
No headerAny site can frame the page, unless CSP frame-ancestors blocks it.

Example

HTTP response header
X-Frame-Options: SAMEORIGIN

Only pages on the same origin may frame this page. Every frame above it must match, not only the direct parent.

How to set it

Send the header from the server of the page that goes in the frame. To block all frames, also send CSP frame-ancestors for current browsers.

# Only your own site may frame this page
X-Frame-Options: SAMEORIGIN

# No site may frame this page
X-Frame-Options: DENY

A meta tag cannot set this header. To allow a partner site, remove X-Frame-Options and list the partner in CSP frame-ancestors.

Learn more

Sources

Know before you embed.

Free, no sign-up, nothing stored. Paste a URL and get a verdict, a live preview, and the fix.

Test a URLBrowse guides