Security Tools
X-Frame-Options Checker
Check whether a website sends an X-Frame-Options header to prevent clickjacking.
Enter a domain to check whether it sends an X-Frame-Options header.
JustChecker monitors your security headers continuously and alerts you if any regress.
Frequently Asked Questions
Clickjacking tricks a visitor into clicking something on your site while it's invisibly loaded inside an attacker's page (in an iframe) - X-Frame-Options tells browsers whether your page is allowed to be embedded in a frame at all, blocking this technique.
DENY blocks your page from being framed anywhere, including your own other pages; SAMEORIGIN allows framing only by pages on your own domain - most sites that don't intentionally use iframes of their own content choose DENY.
It's being gradually superseded by CSP's frame-ancestors directive, which offers more granular control (allowing specific trusted domains rather than just same-origin-or-nothing) - but X-Frame-Options remains widely supported and still valuable, especially for older browsers.
Yes - the point is preventing OTHER, malicious sites from framing your content without your permission, not restricting your own intentional use of frames.
Yes - if you intentionally want your content embeddable elsewhere (a shareable widget, for example), a blanket DENY or SAMEORIGIN would break that use case; CSP's frame-ancestors offers the granular allowlisting needed for that scenario instead.
The browser simply refuses to render your page inside the malicious frame at all - the attacking page shows a blank space instead, and the visitor never sees your framed content to be tricked by it.