Which header should I use?

CSP's frame-ancestors is the modern standard; X-Frame-Options is still useful as a legacy-browser fallback.

What if both headers conflict?

The tool flags conflicts like DENY combined with a CSP that allows all origins so you can fix the mismatch.

Does this test my live site?

No, paste headers you've captured yourself (e.g. via curl -I or browser dev tools).

Is my data uploaded to a server?

No. This tool runs entirely in your browser using standard web APIs, so your input never leaves your device and nothing is logged or stored on our servers.

Does it work offline and on mobile?

Yes. Once the page has loaded it keeps working without a network connection, and the layout is responsive so it stays usable on phones and tablets.

X-Frame-Options / Clickjacking Checker

Check if X-Frame-Options and CSP frame-ancestors block framing.

Support

Works Offline

Privacy First

No Login

No API

Paste response headers

Clickjacking analysis

Framing appears blocked

warn
CSP is present but has no frame-ancestors directive.
good
X-Frame-Options: SAMEORIGIN

Recommended headers

Content-Security-Policy: frame-ancestors 'self';
X-Frame-Options: SAMEORIGIN

About the X-Frame-Options / Clickjacking Checker

Paste response headers to evaluate whether X-Frame-Options and CSP frame-ancestors actually block your page from being embedded in an iframe, detect conflicts between the two, and get recommended headers.

Examples

No protection

Content-Type: text/html

Output

Framing is NOT blocked

Keyboard shortcuts

Copy the main outputCtrl / ⌘ + Shift + C
Download the resultCtrl / ⌘ + S
Share this toolCtrl / ⌘ + Shift + S
Reset the inputsAlt + R
Open the tool search paletteCtrl / ⌘ + K

Related tools

CORS Config Generator

Security

Generate CORS headers/config for Nginx, Apache, Express, or Workers.

CSP Builder

Security

Build a Content-Security-Policy header from per-directive sources.

Permissions-Policy Header Generator

Security

Build a Permissions-Policy header controlling camera, geolocation and more.

Referrer Policy Generator

Security

Pick a Referrer-Policy value and get header/meta/server snippets.

Robots.txt Security Checker

Security

Scan robots.txt for accidental disclosure of sensitive paths.

Security Headers Auditor

Security

Grade HTTP response headers against security best practices.

Frequently asked questions

Version 1.0.0 · Updated 2026-08-10 · Runs entirely in your browser