Iframe Tester
Check if a website can be embedded
Enter any URL below to instantly check if the website allows being embedded inside an <iframe>. Our tool provides a live visual preview. If a site uses X-Frame-Options or Content-Security-Policy to block iframes, the browser will refuse to connect.
Frequently asked questions
Enter the website's URL into our Iframe Tester tool above and click Test. The tool will check the target server's HTTP headers and render a real iframe. If the site is visible and the tool says 'Embedding Allowed', you can safely embed it.
Most major websites block iframe embedding to protect users from clickjacking attacks, protect logged-in sessions, and prevent their content from being wrapped by other sites. They use headers like X-Frame-Options and Content-Security-Policy to enforce this.
X-Frame-Options is an HTTP response header that controls whether a browser is allowed to render a page in an iframe. DENY means the page cannot be displayed in a frame, regardless of the site attempting to do so. SAMEORIGIN allows it only if the site is the exact same domain.
frame-ancestors is a modern Content Security Policy directive that specifies valid parents that may embed a page. It supersedes X-Frame-Options. For example, 'none' blocks all embedding, while 'self' allows embedding only on the same origin.
If you see a 'refused to connect' error in your browser, it means the website you are trying to embed explicitly forbids it via security headers. The browser respects these headers and blocks the connection. The site itself is not down; it just doesn't want to be framed.