#338 · Developer Tool

X Frame Options Checker

Check X-Frame-Options alongside CSP frame-ancestors to find missing, obsolete, or contradictory clickjacking controls. The report recognizes DENY and SAMEORIGIN, flags ALLOW-FROM as obsolete, detects duplicate response fields, and explains which policy modern browsers prioritize. Paste a raw header block rather than a URL. This keeps the diagnosis deterministic and avoids CORS restrictions on remote header inspection.

Developer Input

Response headers
Ad space

How to use this developer tool

  1. Paste the response headers or load the included sample.
  2. Adjust any tool-specific option shown below the input.
  3. Select Check Framing Policy or press Ctrl/Cmd + Enter.
  4. Review the summary and findings, then copy or download the output.

What this developer tool does

Extracts X-Frame-Options and CSP fields, validates the legacy directive, then compares it with the CSP frame-ancestors source list.

Extracts X-Frame-Options and CSP fields, validates the legacy directive, then compares it with the CSP frame-ancestors source list.

CSP frame-ancestors is the flexible modern control. X-Frame-Options remains useful as a fallback for older clients.

Example

Input

X-Frame-Options: DENY
Content-Security-Policy: default-src 'self'; frame-ancestors 'none'

Output

X-Frame-Options: DENY (valid)
CSP frame-ancestors: none
Conflict: no

Use cases

  • Review a deployment before changing production response headers.
  • Compare application and reverse-proxy configuration.
  • Create a reproducible finding for a security review or pull request.
  • Teach the practical effect of X Frame Options settings.

Tips for reliable output

  • Use the complete header value, including repeated fields.
  • Test the final response after CDN and proxy processing.
  • Keep a copy of the before and after output for review.
  • Do not treat a passing result as a penetration test.
  • Recheck after framework, server, or browser-policy updates.

Processing details

Header names and directive values are compared case-insensitively. The CSP parser handles a single frame-ancestors directive and reports multiple declarations.

Meta tags cannot reliably set X-Frame-Options or frame-ancestors. This check does not inspect nested proxy responses.

Frequently asked questions

Is CSP frame-ancestors better than X-Frame-Options?

The checker reports this directly from the supplied response headers and shows the relevant value in its output.

Why is X-Frame-Options ALLOW-FROM considered obsolete?

Use the result together with the browser and server behavior you support; the page does not make remote requests.

Can DENY conflict with frame-ancestors self?

Review the generated finding before deployment, especially when proxies or CDNs can alter headers.

What happens when X-Frame-Options appears twice?

The implemented rule follows current HTTP security-header practice and flags values it cannot recognize.

Does X-Frame-Options protect every response from clickjacking?

Retest with the exact production response because small header changes can affect the conclusion.

Checks and output

StageWhat is reported
ParseRecognized input fields and values
ValidateInvalid, missing, or conflicting settings
ExportText, CSV, and JSON when structured data is available

HTTP & Security Headers

Browse more tools for HTTP behavior, browser policies, cookies, CORS, CSP, and response-header security.

View HTTP & Security Headers