Frame-ancestors header generator

Choose who may embed your site. Get the Content-Security-Policy header and the config for your server.

Updated Oct 14, 2026

Who may embed your pages?

Nobody'none'

No site can show your pages in a frame.

Only my site'self'

Pages on the same origin can frame each other.

My site and these sites'self' + list

Add each origin that may frame you.

Any site*

Every site can show your pages in a frame.

Also send X-Frame-Options for old browsers

Adds X-Frame-Options: SAMEORIGIN, for browsers that do not support frame-ancestors.

Report-only (test first)

Browsers report a block but do not stop it. Uses Content-Security-Policy-Report-Only.

Your headerValid · 1 directive

Content-Security-Policy: frame-ancestors 'self'

X-Frame-Options: SAMEORIGIN

Only pages on your own origin may embed your pages. All other sites are blocked.

nginx.conf · inside your server { } block

add_header Content-Security-Policy "frame-ancestors 'self'" always;
add_header X-Frame-Options "SAMEORIGIN" always;

Already send a Content-Security-Policy? Add frame-ancestors to it. With two policies, a frame must pass both.An add_header in a location block replaces the ones from the server block. Add it there too.

Content-Security-Policy

sent · enforced

X-Frame-Options

SAMEORIGIN

Allowed origins

self

Test it after deploy

Paste a page from your site. We read its headers and try to frame it.

Learn

How frame-ancestors works

The browser reads this header on your page. It then checks the site that tries to frame it. Send it as an HTTP header. It does not work in a meta tag.

01
It wins over X-Frame-Options
When a page sends both headers, modern browsers use frame-ancestors and ignore X-Frame-Options. Keep X-Frame-Options only as a fallback for old browsers.
02
There is no ALLOW-FROM
X-Frame-Options: ALLOW-FROM is obsolete. Current browsers ignore it. To allow other sites, list them in frame-ancestors.
03
Wildcards cover subdomains only
https://*.partner.com matches app.partner.com and eu.app.partner.com. It does not match partner.com. Add the bare domain as its own entry.

Test it after deploy

How frame-ancestors works

It wins over X-Frame-Options

There is no ALLOW-FROM

Wildcards cover subdomains only

Know before you embed.