Clickjacking Protection Tester

Check whether a page can be framed by another site, by reading CSP frame-ancestors and X-Frame-Options together and reporting which one actually applies.

Passive public check

a2z.tools reads publicly visible information from the address you enter. It is a read-only request - nothing is submitted, changed or probed.

Address to check Reads the response headers of a public page. Nothing is framed, submitted or altered.

What clickjacking is, and what actually stops it

Clickjacking loads your page inside an invisible frame on someone else's site, positions it under a decoy, and captures clicks the visitor believes they are giving to something else. The visitor is genuinely logged in and genuinely clicking; the interface they can see is not the one receiving the click. It matters most on pages where a single click does something - confirming a payment, granting an OAuth permission, changing a setting, deleting an account.

Two response headers control whether your page can be framed at all. This tool reads both, because the interesting failures only appear when you look at them together.

frame-ancestors wins where both are set

Content-Security-Policy: frame-ancestors and X-Frame-Options do the same job, and when both are present the CSP directive takes precedence - any browser that supports CSP ignores X-Frame-Options entirely.

That produces a failure worth naming, because it is invisible to most tools. A site with a permissive frame-ancestors and a strict X-Frame-Options: DENY is framable. Anything that reports the two headers separately shows the strict one and looks fine. This tool reports the combination and tells you which header is actually in force.

ALLOW-FROM does nothing

X-Frame-Options: ALLOW-FROM https://partner.example was never widely implemented and is ignored by every current browser. A page relying on it to permit one specific partner while blocking everyone else is simply unprotected. frame-ancestors is the only working way to name permitted origins, and it accepts a list.

Report-only does not block

A frame-ancestors directive in Content-Security-Policy-Report-Only records violations and permits the framing anyway. This is a common state to get stuck in after a careful rollout, so it is reported separately rather than counted as protection.

Choosing a value

frame-ancestors 'none' - the page is never framed by anyone, including you. The right default for a login page, an account settings page or a payment confirmation.
frame-ancestors 'self' - only your own pages may frame it. Correct for a page you embed in your own application.
frame-ancestors 'self' https://partner.example - name the origins that legitimately embed you. Use this instead of loosening to a wildcard.

Keep X-Frame-Options: SAMEORIGIN alongside it for older clients. Sending both is harmless as long as they agree - and this tool tells you when they do not.

What this check cannot tell you

It reads one URL. Framing protection is set per response, so a site can protect its home page and leave an account page open, and that is exactly the pattern worth checking for. Run it against the pages that actually carry actions rather than the front door. The check also cannot see protection implemented in JavaScript - frame-busting script is unreliable and easily defeated, so its absence from this report is not a gap in the report.

Frequently asked questions

Is X-Frame-Options obsolete?

It is superseded, not obsolete. Current browsers still honour it when no frame-ancestors directive is present, so it remains a useful fallback. Set both, and make sure they agree - where they disagree, frame-ancestors is the one that applies.

Does this tool actually try to frame my page?

No. It reads the response headers and reports what they mean. Framing your page to demonstrate the problem would be building an attack page, which is not something this site does.

Why is a missing header only medium severity?

Because the impact depends entirely on what the page does. An unframable marketing page is not a risk; an unframable account-deletion confirmation is. The severity reflects the general case, and you should weigh it against the page you checked.

My page is inside my own app and must be framable. What should I set?

frame-ancestors 'self' if the embedding page is on the same origin, or name the specific origin if it is not. The goal is to be explicit about who may frame you, not to block framing in every case.

References

Related tools

What this tool can and cannot tell you. It reports the configuration a site exposes to an ordinary visitor. It does not log in, submit anything, or test for vulnerabilities, so a passing result means the public configuration looked correct at the moment of the check - not that the site is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.