Security Tools

X-Frame-Options Checker

Check whether a site stops other websites from loading it inside a frame.

Not sure what to enter? Try an example: github.com

Free & instant No signup How to use FAQ

Present

github.com

X-Frame-Options

deny

Last checked: 1 minute ago Cached

Download JSON Download PDF

Enter a URL to see whether it sends X-Frame-Options (or a frame-ancestors rule) that prevents clickjacking.

What does X-Frame-Options do?

X-Frame-Options tells browsers whether your pages may be shown inside a frame on another site. Setting it to DENY or SAMEORIGIN prevents clickjacking, where an attacker overlays your page in a hidden frame to trick users into clicking. The modern equivalent is CSP's frame-ancestors directive.

How to check X-Frame-Options

Enter the domain in the box above.
Click Check X-Frame-Options.
Confirm the header is set to DENY or SAMEORIGIN.
If a partner site must frame your pages, use CSP frame-ancestors to allow just that origin.

Related checks

For the Content-Security-Policy, use the CSP Checker.
For all security headers at once, use the Security Headers Checker.

If the header is missing, add X-Frame-Options: SAMEORIGIN or a frame-ancestors rule in your CSP to stop other sites framing your pages. JustChecker re-checks your security headers regularly so the fix stays in place.

Frequently Asked Questions

An attacker loads your page invisibly inside their own and tricks visitors into clicking buttons on it - for example "delete account" or "pay". Blocking framing stops it.

SAMEORIGIN lets your own site frame its pages (common in admin panels and page builders); DENY blocks framing completely. SAMEORIGIN is the safer default for most sites.

CSP frame-ancestors replaces it in modern browsers, but sending both is harmless and still protects older browsers.

Share this tool:

Need a website for your business? Only $599