Iframe Tester
Load any website in an iframe and check if it can be embedded. When it can't, see why it doesn't load.
Full width × 640px
See why an iframe is blank
A site that refuses to be embedded shows up as an empty frame, with the reason hidden in its response headers. This iframe tester reads X-Frame-Options and Content-Security-Policy frame-ancestors, and names the one that blocks the page.
Why iframes refuse to connect
"Refused to connect" means the site sends a header that leaves your site out. Only the site owner can change it. If the site is yours, remove X-Frame-Options and list the domains allowed to embed it in frame-ancestors.
- X-Frame-Options: DENY. No site may embed the page.
- X-Frame-Options: SAMEORIGIN. Only pages on the same domain may embed it.
- frame-ancestors. The newer rule, set in Content-Security-Policy, and it overrides X-Frame-Options.
- Mixed content. Browsers block an http:// page inside an https:// page, whatever the headers say.
- Third-party cookies. The page loads logged out, because browsers hold back its cookies inside another site.
Test embed code before it goes live
Embed code from YouTube, Google Maps or a form builder can break once it sits on your page. The tester renders pasted embed code in a sandboxed frame that cannot read your cookies.
View a website on mobile
A narrowed desktop browser is only a rough guess at how a site looks on a phone. The tester shows any page at phone, tablet, laptop and desktop sizes, or at a size you choose.
Sandbox, messages and iframe code
- Sandbox flags. Turn each sandbox permission on or off to find the fewest a page needs.
- postMessage log. Every message the framed page sends to its parent window.
- Iframe code. A ready iframe tag with your size and sandbox flags, fixed or responsive.
More Website Tools
Check how a link looks when shared with the OpenGraph Image Tester, read the HTML behind a page with View Page Source, capture it with Website Screenshot, or grab its icon with the Favicon Downloader.
FAQs
How do I test an iframe?
Enter the address and press Test. The tester loads the page in an iframe and checks its headers at the same time.
How do I check if a website can be embedded in an iframe?
Enter its address here. The tester reads X-Frame-Options and Content-Security-Policy frame-ancestors, and says whether any site, only its own site, only listed sites, or no site may embed it.
Why does my iframe say "refused to connect"?
The site sends X-Frame-Options or a frame-ancestors rule that leaves your site out. Only the site owner can change it, so link to the page instead.
What is X-Frame-Options?
An HTTP header that tells browsers whether other sites may show the page in a frame. DENY blocks every site, and SAMEORIGIN allows only the page’s own domain.
Which wins, X-Frame-Options or frame-ancestors?
frame-ancestors. Browsers ignore X-Frame-Options when both are set, and frame-ancestors only works as a header, not in a meta tag.
Can I bypass X-Frame-Options?
Not from your own page, because the visitor’s browser enforces it. A proxy that strips the header breaks logins and often the site’s terms.
How do I test embed code?
Switch to "Test embed code", paste the snippet and press Render. It runs in a sandbox that cannot read this page or your cookies.
How do I view a website on mobile?
Pick Mobile or Tablet above the preview, or set your own width and height. Rotate switches it to landscape.
Can I get the iframe code?
Yes. The tester writes an iframe tag with your size, sandbox flags and lazy loading, fixed or responsive.
Do you store the URLs I test?
No. The page loads straight from its own site into your browser, and the header check keeps nothing.