Can your site be framed?
Clickjacking hides your page in an invisible iframe so visitors click things they can't see. Test any URL for the two headers that stop it.
How the test works
An attacker loads your page in a transparent iframe over their own. Visitors see the attacker's page, but their clicks land on yours: a delete button, a payment confirmation, a permissions prompt.
Browsers refuse to frame a page when its response includes either header:
Content-Security-Policy: frame-ancestors- The modern control.
'none'blocks all framing,'self'allows your own origin. It doesn't inherit fromdefault-src, and when present, browsers ignore X-Frame-Options. X-Frame-Options- The legacy fallback. Use
DENYorSAMEORIGIN.ALLOW-FROMis obsolete and makes modern browsers ignore the whole header.
This tool sends a HEAD request, then retries with GET if HEAD is rejected or comes back without framing headers, since some servers only add them to GET. It reads headers only. It doesn't run JavaScript, so frame-busting scripts aren't counted; they're easily bypassed anyway.
Further reading
- X-Frame-Options referenceEvery directive, browser support, and why ALLOW-FROM breaks the header.
- CSP frame-ancestors referenceSyntax, the wildcard gotcha, and why meta tags are ignored.
- X-Frame-Options vs CSP frame-ancestorsWhich one browsers enforce when both are present.
- Scanner says “missing anti-clickjacking header”What ZAP, Nessus, Burp, and Qualys alerts mean.
- DoubleClickjackingThe window-swap attack that framing headers can’t stop.
- Why frame-busting scripts failFive ways attackers bypass JavaScript defenses.