# Iframe Detector — Full content

> This file aggregates the complete public text of every page on iframe-detector.com plus an extended FAQ and reference section, in a single markdown document optimised for LLM ingestion. It follows the [llmstxt.org](https://llmstxt.org/) `llms-full.txt` convention.

For a shorter, structured pointer file see [llms.txt](https://iframe-detector.com/llms.txt). For the canonical web page versions, see the links at the bottom of each section.

---

## Page: Homepage (`/`)

Canonical: https://iframe-detector.com/

### Hero

**Eyebrow:** Iframe Detector · Free iframe checker for Chrome

**Heading:** Every iframe on any page. One tap away.

**Description:** Iframe Detector is a free Chrome extension that checks, detects and highlights every iframe on any page — same-origin, cross-origin, ads, hidden trackers. Copy, inspect, export. Built for developers and QA.

**Primary call to action:** Add to Chrome — free (links to the Chrome Web Store at https://chromewebstore.google.com/detail/ejjjchfedlceehnpkpfbdgbmbaaeoffn)

**Hero stats:**

- 0 URLs tracked
- 176 KB installed size
- 3 export formats

### Iframe zoo (named examples)

Real-world iframe types Iframe Detector identifies:

- Video embed (cross-origin, e.g. YouTube)
- Ad slot 300×250 (ad, e.g. DoubleClick)
- Payment widget (cross-origin, e.g. Stripe)
- Newsletter signup (same-origin)
- Social embed (cross-origin, e.g. Twitter/X)
- Tracking pixel 1×1 hidden (hidden, often analytics)

### Features

- **Instant scan** — Checks and counts every iframe, visible or hidden, the moment the tab loads.
- **Origin breakdown** — Color-coded: same-origin, cross-origin, ad slots and trackers.
- **In-page highlight** — Draws a dashed outline around each frame with an origin-tinted badge.
- **Copy & inspect** — One click copies the URL or opens the full `<iframe>` tag.
- **Three exports** — JSON, CSV, or Markdown — fits whatever tool you use next.
- **Privacy-first** — Anonymous, aggregate-only usage events (e.g. "popup opened") — no URLs, no page content, no PII.

### How it works — three steps

1. **Install** — One click from the Chrome Web Store — no account, no setup.
2. **Scan** — Open any page, click the toolbar icon. Check every iframe in the list — visible, hidden, cross-origin.
3. **Ship** — Copy a URL, toggle highlights, or export the full list in three formats.

### Scenarios

- **Ad audit** — Check and separate real content from tracking pixels in one glance.
- **QA checklist** — Check every embedded frame — each one is a test surface. See the full set.
- **Security sweep** — Check for hidden iframes, 1×1 pixels, suspicious origins — all flagged instantly.

### Export formats

- **JSON** — Structured · full attributes
- **CSV** — Spreadsheet · one row per frame
- **Markdown** — Paste into a ticket

### FAQ (homepage)

**Q: How do I check iframes on a webpage?**
A: Install the free Iframe Detector extension, open any page, and click the toolbar icon. Every iframe — visible, hidden, same-origin, cross-origin — is checked and listed instantly. No account, no setup.

**Q: Does it work on any site?**
A: Yes — it reads the DOM of whichever tab is active. No extra permissions beyond the current tab.

**Q: Are hidden iframes detected?**
A: Yes. One-pixel trackers, `display: none`, and `visibility: hidden` frames all show up and are flagged.

**Q: What does "ad / tracker" mean?**
A: A small heuristic flags frames loaded from known ad-tech and analytics domains. You can see the raw origin too.

**Q: Is any data sent anywhere?**
A: Only anonymous, aggregate feature-usage events (e.g. which button was clicked). No URLs, no iframe contents, no page data — see the Privacy page.

**Q: Can I automate exports?**
A: Yes — the popup exposes JSON, CSV, and Markdown downloads that drop into most audit and ticketing tools directly.

**Q: Does it work in incognito?**
A: Toggle "Allow in incognito" from `chrome://extensions` — the extension keeps the same zero-network stance there.

---

## Page: Privacy Policy (`/privacy`)

Canonical: https://iframe-detector.com/privacy

### Heading

Anonymous, nothing more.

### Lede

Both the Iframe Detector extension and the marketing website you're on send anonymous, aggregate feature-usage events — things like "popup opened", "export clicked", or "FAQ expanded". We do NOT send URLs, page content, iframe contents, or anything that could identify you. This page explains, in plain language, exactly what each side tracks and what neither of them ever touches.

### The short version

- ✓ Reads the active tab's DOM, locally. Only when you click the toolbar icon.
- ✓ Stores your preferences in Chrome sync. Theme, filters, export defaults — that's it.
- ✓ Extension: anonymous feature-usage events. Counts like "popup opened" or "export clicked" — no URLs, no iframe contents, no PII.
- ✓ Website: anonymous, opt-in GA4. Cookieless by default; accept to enable cookies. No PII, no sale.
- × No reading of page content, frame bodies, cookies, or forms. We never touch what's inside the iframes or the rest of the page.
- × No third-party SDKs besides GA4. No ads, trackers, affiliate links.
- × No account. Ever. There's nothing to sign up for.

### What the extension reads

When you click the Iframe Detector toolbar icon, the extension reads the DOM of the currently active tab for `<iframe>` elements. For each frame, it reads: the `src` attribute, computed size, visibility, and the frame's origin relative to the parent page. That information is held in memory and shown in the popup.

The extension does not read the contents of the frames themselves, cookies, local storage, form data, or anything outside `<iframe>` elements.

### What the extension stores

Only preferences. Specifically:

- **UI state:** last-used filter (all / visible / hidden), selected export format, theme.
- **Highlight settings:** whether to show the in-page outline by default, and the outline color.

These are saved in `chrome.storage.sync`. If you are signed into Chrome, they sync across your Chrome profile — this is handled by Chrome, not by us, and we never see the data.

### What the extension sends

The extension fires anonymous, aggregate feature-usage events via Google Analytics 4. These are counters — not logs — and answer questions like: how often is the popup opened, which filter is used most (all / visible / hidden), which export format gets picked, and whether users open the in-page highlight toggle.

Every event carries only the action name (e.g. `popup_opened`, `export_clicked`) and a small set of non-identifying parameters (e.g. the export format chosen). Events are subject to Consent Mode v2 — in aggregate / cookieless mode by default on the website, and aggregate-only for extension events.

**What is never sent:** page URLs, iframe `src` values, iframe contents, page content, cookies, forms, passwords, tokens, or anything tied to a specific site you visit.

### What the extension does NOT do

- No reading of page content, forms, passwords, cookies, tokens, or storage.
- No tracking of which websites or URLs you visit — events carry no site identity at all.
- No crash reporter, heatmap, or session replay.
- No sale or sharing of data — the events are aggregate-only.

### Chrome permissions we request

- **`activeTab`** — Lets the extension run only on the tab you explicitly click from. We do not have background access to your other tabs.
- **`storage`** — Saves your UI preferences (theme, filters) in `chrome.storage.sync`. Nothing else is written here.
- **`host_permissions: <all_urls>`** — Required so the extension can read `<iframe>` elements on any page you explicitly open it on — iframe detection has to work equally on any site. The extension ONLY runs when you click the toolbar icon; it does not monitor your browsing in the background, does not track which sites you visit, and sends no network requests beyond anonymous feature-usage events.

### Exports

When you use JSON / CSV / Markdown export, the file is generated in the browser and downloaded directly by Chrome. It is never uploaded anywhere. You choose where the file goes.

### Third parties

**Extension:** Google Analytics 4 — used only for the anonymous feature-usage events described above. No other third-party SDKs or runtime dependencies; all shipped code is audited and pinned.

**This website:** loads Google Fonts for typography and uses Google Analytics 4 to understand which parts of the page people find useful (aggregate clicks, sections reached, FAQ questions opened). Neither the extension nor the website fingerprints you, sells your data, or cross-references with any other service. If you block analytics scripts, everything works identically.

### Cookies & consent

We use Google Consent Mode v2 with default denied. On your first visit, analytics cookies are NOT set and Google Analytics runs in a cookieless, aggregate-only mode. A small banner asks whether you want to opt in to standard analytics; your choice is stored locally in your browser via `localStorage` (not a cookie) and applies to subsequent visits.

You can change your mind at any time via the **Cookie settings** link in the footer — it re-opens the banner.

Cookies we use only after you accept:

- `_ga` — Google Analytics client identifier, 2-year expiry.
- `_ga_J2L7C1PNSV` — session tracker for this property, 2-year expiry.

We do NOT use advertising cookies (`ad_storage`, `ad_user_data`, `ad_personalization`), personalization cookies, or any third-party cookies beyond Google Analytics.

### Children's privacy

The extension does not collect any personal information, from anyone, at any age. There is nothing to say here beyond "we don't know, and don't want to know, who you are."

### Changes to this policy

If we ever change the extension in a way that touches privacy — for instance, if we ever added an opt-in sync feature — this page would be updated before the feature ships. The repository's commit history is the source of truth.

### Contact

Questions, audits, responsible-disclosure? Email lewawebextensions@gmail.com. We try to reply within two business days.

---

## Reference: detecting iframes on a webpage

### One-liner in DevTools (any browser)

```javascript
document.querySelectorAll('iframe')
```

Returns a `NodeList` of every iframe in the DOM. Hidden frames are included; the call does not differentiate them.

### Counting iframes by visibility

```javascript
const all = document.querySelectorAll('iframe');
const visible = Array.from(all).filter(f =>
  f.offsetParent !== null && f.offsetWidth > 0 && f.offsetHeight > 0
);
console.log({ total: all.length, visible: visible.length, hidden: all.length - visible.length });
```

### Enriched audit with origin and size

```javascript
Array.from(document.querySelectorAll('iframe')).map(f => ({
  src: f.src,
  size: `${f.offsetWidth}x${f.offsetHeight}`,
  visible: f.offsetParent !== null && f.offsetWidth > 0 && f.offsetHeight > 0,
  sameOrigin: (() => {
    try { return new URL(f.src).origin === location.origin; }
    catch { return null; }
  })(),
}));
```

### Detecting whether the current page is inside an iframe

```javascript
const framed = window.self !== window.top;
console.log(framed ? 'Page is inside an iframe' : 'Page is the top-level document');
```

### Preventing your page from being embedded in an iframe

Send one of these response headers:

```http
X-Frame-Options: DENY
Content-Security-Policy: frame-ancestors 'none'
```

CSP `frame-ancestors` is preferred — it supersedes `X-Frame-Options` and supports a domain allowlist (`frame-ancestors 'self' https://trusted.example`).

### Common iframe origins and what they usually are

- `youtube.com/embed/...` — YouTube video embed
- `player.vimeo.com/...` — Vimeo video embed
- `js.stripe.com/...`, `checkout.stripe.com/...` — Stripe payment elements
- `platform.twitter.com/...`, `embed.x.com/...` — Twitter / X embeds
- `connect.facebook.net/...`, `facebook.com/plugins/...` — Facebook widgets
- `googletagmanager.com/...` — Google Tag Manager
- `doubleclick.net/...`, `googlesyndication.com/...`, `googleads.g.doubleclick.net/...` — Google ads
- `facebook.com/tr/...` — Meta tracking pixels (often 1×1)
- `analytics.tiktok.com/...`, `t.co/...` — analytics / tracking pixels

### Hidden iframe patterns

- `width="0" height="0"` — historically used by trackers
- `style="display:none"` — fully hidden
- `style="visibility:hidden"` — occupies space but invisible
- `width="1" height="1"` — 1×1 tracking pixels
- Frames moved off-screen via CSS (`position:absolute; left:-9999px`)

Iframe Detector flags every one of these explicitly.

---

## Reference: same-origin vs cross-origin iframes

### Same-origin

The iframe's URL shares scheme, host, and port with the parent page. The parent can:

- Read and modify the iframe's DOM (`iframe.contentDocument`, `iframe.contentWindow`)
- Read its cookies and storage (subject to `SameSite` cookie attributes)
- Call functions defined inside it directly

### Cross-origin

The iframe's URL differs in scheme, host, or port. The browser enforces the Same-Origin Policy:

- The parent CANNOT read the iframe's DOM, cookies, storage, or scripts
- Communication is allowed only via `postMessage` (explicit message passing)
- The iframe can set its own `Content-Security-Policy` and `X-Frame-Options` to restrict embedding

### Sandboxed iframes

A `sandbox` attribute (e.g. `<iframe sandbox="allow-scripts">`) strips capabilities from the frame regardless of origin: script execution, form submission, top navigation, popups, etc. Without `allow-same-origin`, the frame is treated as a unique opaque origin even if its URL matches the parent.

---

---

## Page: How to detect every iframe on a webpage (`/how-to-detect-iframes/`)

Canonical: https://iframe-detector.com/how-to-detect-iframes/

### Quick answer

Open DevTools (F12) and run `document.querySelectorAll('iframe')` in the Console. That returns a NodeList of every iframe on the page — visible, hidden, same-origin, cross-origin. For a visual list with origin breakdown, hidden-frame flags, and one-click export, install the Iframe Detector Chrome extension.

### Three methods

**Method 1 — DevTools one-liner**

```javascript
document.querySelectorAll('iframe')
```

Iterate it directly:

```javascript
for (const f of document.querySelectorAll('iframe')) {
  console.log(f.src || '(blank)', f.offsetWidth, '×', f.offsetHeight);
}
```

**Method 2 — Enriched audit**

```javascript
Array.from(document.querySelectorAll('iframe')).map(f => {
  const visible =
    f.offsetParent !== null && f.offsetWidth > 0 && f.offsetHeight > 0;
  let sameOrigin = null;
  try { sameOrigin = new URL(f.src).origin === location.origin; }
  catch { /* blank or javascript: src */ }
  return {
    src: f.src || '(blank)',
    size: `${f.offsetWidth}x${f.offsetHeight}`,
    visible,
    sameOrigin,
    sandbox: f.getAttribute('sandbox'),
  };
});
```

**Method 3 — Iframe Detector extension** — one click, same data, plus origin colour-coding, hidden-frame badges, in-page highlight overlay, and JSON / CSV / Markdown export.

### Catching hidden frames

```javascript
Array.from(document.querySelectorAll('iframe')).filter(f =>
  f.offsetParent === null ||
  f.offsetWidth <= 1 ||
  f.offsetHeight <= 1
);
```

### Watching for late-loaded iframes

```javascript
new MutationObserver(records => {
  for (const r of records) {
    for (const n of r.addedNodes) {
      if (!(n instanceof HTMLElement)) continue;
      if (n.tagName === 'IFRAME') console.log('+ iframe', n.src);
      n.querySelectorAll?.('iframe').forEach(f =>
        console.log('+ iframe', f.src)
      );
    }
  }
}).observe(document.body, { childList: true, subtree: true });
```

### Limits of querySelectorAll

- Nested frames are not enumerated recursively. Run the query inside each frame separately. Cross-origin frames refuse access.
- Late-loaded frames are not in the static NodeList — use MutationObserver.
- Shadow DOM iframes inside open shadow roots are reachable; closed shadow roots are not.

---

## Page: Find hidden iframes on any page (`/find-hidden-iframes/`)

Canonical: https://iframe-detector.com/find-hidden-iframes/

### What counts as "hidden"

A hidden iframe is any frame that exists in the DOM but is invisible to the user. It still loads its source, runs its scripts, fires its requests, and counts against the page's performance budget. It just does not occupy visible pixels.

### Six common patterns

- `<iframe src="..." width="0" height="0">` — zero-size; the original tracker pattern
- `<iframe style="display:none">` — removed from layout entirely
- `<iframe style="visibility:hidden">` — occupies its box but pixels are not painted
- `<iframe width="1" height="1">` — 1×1 tracking pixel
- `<iframe style="position:absolute;left:-9999px">` — off-screen
- `<iframe src="about:blank">` — empty / sandboxing frame

### Why it matters

Hidden iframes are how third parties piggy-back on your page: pixel beacons, attribution iframes, fingerprinting probes, A/B-test scaffolding. For a security audit they are the highest-leverage place to look. For a privacy report they are the actual instruments of tracking.

### Hunt them in JavaScript

```javascript
Array.from(document.querySelectorAll('iframe'))
  .map(f => {
    const rect = f.getBoundingClientRect();
    const offParent = f.offsetParent === null;
    const displayNone = getComputedStyle(f).display === 'none';
    const tiny = rect.width <= 1 || rect.height <= 1;
    const offScreen =
      rect.right < 0 || rect.bottom < 0 ||
      rect.left > innerWidth || rect.top > innerHeight;
    const hidden = offParent || displayNone || tiny || offScreen;
    return hidden ? {
      src: f.src || '(blank)',
      size: `${Math.round(rect.width)}x${Math.round(rect.height)}`,
      reason: offParent ? 'display:none / detached' :
              displayNone ? 'display:none' :
              tiny ? '1×1 pixel' :
              offScreen ? 'off-screen' : 'unknown',
    } : null;
  })
  .filter(Boolean);
```

To catch `visibility: hidden` (which does NOT set `offsetParent` to null):

```javascript
Array.from(document.querySelectorAll('iframe'))
  .filter(f => getComputedStyle(f).visibility === 'hidden');
```

### What to do once you find one

1. Trust the origin (Stripe, Meta, your own domain → known; unknown domain → investigate).
2. Check what it loads in the Network tab.
3. Decide: keep, remove, or sandbox (`sandbox="allow-scripts"`).
4. Record it — export the full list and attach to the ticket.

---

## Page: Am I inside an iframe? (`/am-i-in-an-iframe/`)

Canonical: https://iframe-detector.com/am-i-in-an-iframe/

### The one-line check

```javascript
if (window.self !== window.top) {
  console.log('We are inside an iframe');
} else {
  console.log('We are the top-level page');
}
```

### Why window.top and not window.parent

`window.parent` points to the immediate parent — for an iframe nested two levels deep, parent is the middle frame, not the top. `window.top` always points to the outermost window of the browsing context.

### Cross-origin access throws

The check itself never throws. But reading any property of `window.top` (beyond identity comparison) is blocked by the Same-Origin Policy if the parent is on a different origin:

```javascript
const framed = window.self !== window.top;
let crossOrigin = false;
if (framed) {
  try {
    window.top.location.href;
  } catch {
    crossOrigin = true;
  }
}
```

### How to stop your page from being framed

Send both response headers:

```http
X-Frame-Options: DENY
Content-Security-Policy: frame-ancestors 'none'
```

`frame-ancestors` in CSP supersedes `X-Frame-Options` and supports an allowlist (`frame-ancestors 'self' https://trusted.example`). Modern browsers all support `frame-ancestors`; keep `X-Frame-Options` only as a fallback for very old browsers.

### The sandbox caveat

An iframe with `sandbox` but no `allow-same-origin` is treated by the browser as a unique opaque origin, even if its URL matches its parent. `window.self !== window.top` still returns `true`, but touching anything on `window.top` throws.

### Defending the check

A hostile embedding page that loads your script can override `window.top`:

```javascript
Object.defineProperty(window, 'top', { get: () => window.self });
```

For high-security pages, do not rely on the JS check — send the headers and verify the embedding origin server-side.

---

---

## Page: Clickjacking — and how to stop it (`/clickjacking-attack/`)

Canonical: https://iframe-detector.com/clickjacking-attack/

### Quick answer

Send `X-Frame-Options: DENY` and `Content-Security-Policy: frame-ancestors 'none'` on every authenticated route. JavaScript frame-busting is deprecated; SameSite=Lax cookies help but are not the main defense.

### What clickjacking is

An attacker loads your page in a transparent iframe (`opacity: 0`) on top of their own page, lines up your sensitive button with their bait button, and waits for the victim's click. The browser sees a legitimate authenticated click on your real button.

### Working proof of concept

```html
<!DOCTYPE html>
<title>You won a prize!</title>
<style>
  .bait { position: absolute; top: 200px; left: 200px; padding: 20px 40px; }
  iframe { position: absolute; inset: 0; width: 100%; height: 100%; opacity: 0.001; border: 0; }
</style>
<div class="bait">Click to claim &rarr;</div>
<iframe src="https://target.example/account/delete"></iframe>
```

### How to check whether your site is vulnerable

```bash
curl -sSI https://yoursite.example/account | grep -iE 'x-frame-options|content-security-policy'
```

If neither header is set, the site is currently embeddable.

### The four defenses

1. `Content-Security-Policy: frame-ancestors 'none'` (or `'self'` / partner allowlist) — modern, recommended.
2. `X-Frame-Options: DENY` (or `SAMEORIGIN`) — legacy, supersedes CSP on old browsers only.
3. `SameSite=Lax` cookies — defense in depth, blocks one specific delivery vector.
4. JavaScript frame-busting (`if (top !== self) top.location = self.location`) — deprecated, trivially defeated by HTML5 sandbox.

### Server config snippets

Nginx:
```
add_header X-Frame-Options "DENY" always;
add_header Content-Security-Policy "frame-ancestors 'none'" always;
```

Apache:
```
Header always set X-Frame-Options "DENY"
Header always set Content-Security-Policy "frame-ancestors 'none'"
```

Express + helmet:
```javascript
app.use(helmet.frameguard({ action: 'deny' }));
app.use(helmet.contentSecurityPolicy({ directives: { frameAncestors: ["'none'"] } }));
```

---

## Page: The iframe sandbox attribute (`/iframe-sandbox-attribute/`)

Canonical: https://iframe-detector.com/iframe-sandbox-attribute/

### What sandbox does

`sandbox=""` (empty value) strips: scripts, forms, popups, modals, top-navigation, downloads, presentation, pointer-lock, orientation-lock. Sets the frame's origin to a unique opaque value. Each `allow-*` token re-enables one specific capability.

### All sandbox flags

- `allow-scripts` — re-enable JavaScript
- `allow-same-origin` — restore real origin (dangerous with allow-scripts on same-origin frames)
- `allow-forms` — re-enable form submission
- `allow-popups` — re-enable window.open()
- `allow-popups-to-escape-sandbox` — popups created are unsandboxed
- `allow-modals` — re-enable alert / confirm / prompt / print
- `allow-top-navigation` — re-enable window.top.location writes
- `allow-top-navigation-by-user-activation` — top-navigation only after user gesture
- `allow-downloads` — re-enable downloads
- `allow-presentation` — re-enable Presentation API
- `allow-pointer-lock` — re-enable requestPointerLock()
- `allow-orientation-lock` — re-enable screen.orientation.lock()
- `allow-storage-access-by-user-activation` — re-enable Storage Access API

### The dangerous combination

`sandbox="allow-scripts allow-same-origin"` on a frame whose URL matches the parent origin lets the frame script reach `window.frameElement`, remove the sandbox attribute, and reload unsandboxed. Avoid this pairing; if you must combine both flags, host the frame on a different origin.

### Recipes

```html
<!-- Untrusted user HTML -->
<iframe sandbox srcdoc="<h1>Untrusted</h1>"></iframe>

<!-- Third-party widget -->
<iframe src="https://widget.partner.example" sandbox="allow-scripts allow-popups allow-forms" loading="lazy"></iframe>

<!-- Payment iframe -->
<iframe src="https://js.stripe.com/v3/..." sandbox="allow-scripts allow-same-origin allow-forms allow-popups" allow="payment"></iframe>

<!-- OAuth provider -->
<iframe src="https://login.provider.example/..." sandbox="allow-scripts allow-forms allow-top-navigation-by-user-activation"></iframe>
```

---

## Page: The iframe cheat sheet (`/iframe-cheat-sheet/`)

Canonical: https://iframe-detector.com/iframe-cheat-sheet/

### Every iframe attribute

| Attribute | Value | Purpose |
|---|---|---|
| `src` | URL | URL of the document to embed (mutually exclusive with srcdoc) |
| `srcdoc` | HTML | Inline HTML to render |
| `name` | token | Targetable name for window.open / form target |
| `title` | string | Accessible label (required for screen readers) |
| `sandbox` | tokens | Capability deny-list |
| `allow` | Permissions-Policy | Feature allowlist |
| `allowfullscreen` | boolean | Permits requestFullscreen() |
| `referrerpolicy` | policy | Referer header to send |
| `loading` | lazy / eager | Defer off-screen frames |
| `fetchpriority` | high / low / auto | Resource scheduling hint |
| `width` / `height` | dimensions | Sized rendering |
| `csp` | policy | Experimental embed-only CSP |

### Common Permissions-Policy features (for `allow=`)

`camera`, `microphone`, `geolocation`, `payment`, `fullscreen`, `autoplay`, `encrypted-media`, `clipboard-read`, `clipboard-write`, `publickey-credentials-get` (WebAuthn), `usb`, `serial`, `hid`, `midi`, `xr-spatial-tracking`, `display-capture`, `cross-origin-isolated`, `interest-cohort`, `browsing-topics`.

### referrerpolicy values

`no-referrer`, `no-referrer-when-downgrade`, `origin`, `origin-when-cross-origin`, `same-origin`, `strict-origin`, `strict-origin-when-cross-origin` (modern default), `unsafe-url` (avoid).

### Defense headers

```
X-Frame-Options: DENY
Content-Security-Policy: frame-ancestors 'none'
Content-Security-Policy: frame-src 'self' https://*.youtube.com
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()
```

### Paste-ready snippets

```html
<!-- YouTube with full defenses -->
<iframe src="https://www.youtube-nocookie.com/embed/VIDEO_ID"
        title="..." loading="lazy"
        referrerpolicy="strict-origin-when-cross-origin"
        allow="autoplay; encrypted-media; picture-in-picture"
        allowfullscreen></iframe>

<!-- Stripe payment -->
<iframe src="https://js.stripe.com/v3/..."
        allow="payment"
        sandbox="allow-scripts allow-same-origin allow-forms allow-popups"></iframe>
```

```javascript
// List every iframe
document.querySelectorAll('iframe')

// Check if framed
const framed = window.self !== window.top;

// Find hidden iframes
Array.from(document.querySelectorAll('iframe')).filter(f =>
  f.offsetParent === null || f.offsetWidth <= 1 || f.offsetHeight <= 1
);
```

---

## Page: Lazy-loading iframes (`/iframe-lazy-loading/`)

Canonical: https://iframe-detector.com/iframe-lazy-loading/

### What loading="lazy" does

Defers the iframe's fetch until the browser determines it is near the viewport. Chrome uses ~1250px below-fold on desktop, ~1500px on mobile as the threshold. Implemented in every major browser since 2022. Older browsers ignore the attribute and load the iframe eagerly (correct fallback).

### Core Web Vitals impact

- **LCP** — deferring heavy below-fold iframes frees the network for the LCP element. Real pages with one YouTube embed see 500–2000 ms LCP improvements.
- **INP** — fewer competing iframe scripts means less main-thread contention during user interaction.
- **CLS** — lazy-loading does NOT prevent layout shift. Reserve the iframe's `width`/`height` or use `aspect-ratio` CSS to avoid regression.

### When NOT to lazy-load

1. Above-the-fold iframes (especially LCP candidates)
2. Critical interactions (payments, OAuth, consent banners)
3. Frames other code depends on for initialization

### Pairing with fetchpriority

```html
<iframe src="..." loading="lazy"></iframe>                    <!-- below-fold video -->
<iframe src="..." loading="lazy" fetchpriority="low"></iframe>  <!-- tracking pixel -->
<iframe src="..." loading="eager" fetchpriority="high"></iframe> <!-- hero embed -->
```

---

## Page: Common iframe domains, decoded (`/common-iframe-domains/`)

Canonical: https://iframe-detector.com/common-iframe-domains/

Reference of the most common iframe origins on the modern web. Useful for ad audits, GDPR reviews, security sweeps.

### Video & media

- `youtube.com/embed`, `youtube-nocookie.com/embed` — YouTube player (use nocookie for privacy)
- `player.vimeo.com/video` — Vimeo
- `open.spotify.com/embed` — Spotify
- `w.soundcloud.com/player` — SoundCloud
- `player.twitch.tv` — Twitch

### Payments

- `js.stripe.com`, `m.stripe.network` — Stripe Elements (controller frame is hidden)
- `www.paypal.com/sdk` — PayPal Checkout
- `assets.braintreegateway.com` — Braintree hosted fields
- `checkoutshopper-live.adyen.com` — Adyen / 3DS
- `pay.google.com/gp/p/ui` — Google Pay

### Social embeds

- `platform.twitter.com`, `embed.x.com` — Twitter / X
- `instagram.com/p/.../embed` — Instagram
- `www.facebook.com/plugins` — Facebook
- `www.tiktok.com/embed` — TikTok
- `www.linkedin.com/embed` — LinkedIn
- `redditmedia.com` — Reddit

### Analytics, ads & trackers (privacy-sensitive)

- `googletagmanager.com/ns.html` — GTM noscript (hidden tracker)
- `doubleclick.net`, `googlesyndication.com`, `googleads.g.doubleclick.net` — Google ads
- `www.facebook.com/tr`, `connect.facebook.net` — Meta Pixel (1×1 tracker, GDPR-relevant)
- `px.ads.linkedin.com` — LinkedIn Insight Tag
- `static.hotjar.com` — Hotjar session replay
- `static.ads-twitter.com` — Twitter pixel
- `analytics.tiktok.com` — TikTok Pixel
- `stats.g.doubleclick.net` — GA4 ad beacon

### Customer support

- `widget.intercom.io` — Intercom
- `js.driftt.com` — Drift
- `static.zdassets.com` — Zendesk
- `embed.tawk.to` — Tawk.to

### Maps

- `google.com/maps/embed` — Google Maps
- `api.mapbox.com` — Mapbox

### Authentication / SSO (often hidden)

- `accounts.google.com/gsi` — Google Sign-In silent renewal
- `login.microsoftonline.com` — Microsoft Entra silent auth
- `*.auth0.com` — Auth0 silent renewal

---

## Page: Iframe checker tools, compared (`/iframe-checker-tools-compared/`)

Canonical: https://iframe-detector.com/iframe-checker-tools-compared/

Honest comparison of five approaches:

1. **DevTools Elements panel** — built-in, structural, no flat list or export
2. **DevTools Console snippets** — flexible, but requires re-pasting per site
3. **Iframe Detector extension** — one click, origin classification, hidden flags, export
4. **Wappalyzer / Ghostery / Privacy Badger** — adjacent problems (tech detection, blocking)
5. **Custom MutationObserver script** — automation, CI integration, high friction for human use

### When to pick which

- **One-off debugging** → DevTools Elements
- **Repeated audits** → Iframe Detector
- **Automated pipeline (CI, Playwright)** → MutationObserver script
- **Actually blocking trackers** → Ghostery, Privacy Badger, uBlock Origin

### Iframe Detector — full disclosure

Free, MIT-licensed, no paid tier, no in-extension purchases. Sends only anonymous aggregate feature-usage events via GA4 (which button was clicked) — no URLs, no iframe contents, no PII. See `/privacy` for the full policy.

---

## Authority and source

- Canonical product page: https://iframe-detector.com/
- Canonical install: https://chromewebstore.google.com/detail/ejjjchfedlceehnpkpfbdgbmbaaeoffn
- Guides hub: https://iframe-detector.com/guides/
- Privacy policy: https://iframe-detector.com/privacy
- llms.txt pointer: https://iframe-detector.com/llms.txt
- Contact: lewawebextensions@gmail.com
- License: MIT (extension); copyright 2026 Iframe Detector team