Instant verdict with evidence
See whether the load event fired, how long it took, and which rule produced the result. Never wonder if it's 'still loading'.
Iframe Viewer: test if a URL loads in an iframe
Paste a URL to render it in a real iframe, detect X-Frame-Options / CSP frame-ancestors blocking, and preview it at device sizes. Nothing is sent to a server.
about:blank
1280×800
Enter a URL above to render it here
- Nothing is sent to a server
- Sandbox & permission testing
- 10 device presets + compare mode
How it works
How detection works
Browsers hide why a cross-origin frame failed, so the result combines deterministic checks with the browser's own signals and always states which one applied.
- 01
Paste a URL or an <iframe> snippet
We normalise it (adding https:// if you forgot), validate it, and check mixed-content rules and the known-policy database before touching the network.
- 02
The browser renders it at device size
A real iframe is created at the exact preset resolution and CSS-scaled to fit. Sandbox, allow and referrer options are applied verbatim.
- 03
You get a verdict, the evidence, and the code
Load event timing, the signal that decided the result, a curl one-liner to confirm headers, and a snippet mirroring your current settings.
Features
What the tool does
Real device viewports
iPhone 15, Pixel 8, iPad Pro, 1440p desktop. Rendered at native pixels and scaled to fit — with a rotate toggle.
Compare mode
Phone, tablet and laptop side by side from a single URL. Catch responsive breakage inside the embed before your users do.
Sandbox & permissions lab
Toggle sandbox flags, allow= features and referrer policy live. Some sites only frame when the referrer looks right — now you can prove it.
HTML, React, Vue, Svelte output
One config, four idiomatic snippets. camelCase props for React, a responsive aspect-ratio wrapper when you want it.
Known-policy database
Popular sites that block framing are flagged instantly — with the header they send and the official embed alternative.
Private by design
There is no backend. URLs, history and generator settings live in your browser's localStorage and nowhere else.
Shareable results
Every test has a URL. Drop it in a ticket or Slack so a teammate sees exactly what you saw.
FAQ
Frequently asked questions
Why does the iframe show up blank or say “refused to connect”?
The site sent an X-Frame-Options header (DENY or SAMEORIGIN) or a Content-Security-Policy with a frame-ancestors directive that doesn't include your origin. Browsers honour that and render an error page instead. The exact header is visible in DevTools → Console, or via the curl command Iframe Viewer gives you.
How do I test if a website can be embedded in an iframe?
Paste the URL into the iframe tester above and press Render. Iframe Viewer loads it in a real iframe at your chosen device size and reports whether the load succeeded, which signal decided the result, and how long it took.
Can Iframe Viewer read the X-Frame-Options header directly?
Not from the browser alone — cross-origin response headers are hidden from JavaScript by design. Iframe Viewer combines deterministic checks (mixed content, a curated database of popular sites), the browser's load event and a same-origin probe, and always tells you which signal produced the verdict. Use the curl one-liner for ground truth.
The tester says “Load event fired” but I still see an error page. Which is right?
Both. Chrome and Firefox fire load even when they substitute an error page, so the event alone can't distinguish success from a block. Trust your eyes for the final call and use the curl command to confirm.
Does Iframe Viewer store or log the URLs I test?
No. There is no server. Your history is saved in your browser's localStorage so it survives refreshes, and you can clear it with one click. Analytics, if you accept them, only count page views and button clicks — never the URLs you test.
What's the difference between allow and sandbox?
sandbox removes capabilities (scripts, forms, popups, navigation) and you add back only what you need. allow is the Permissions Policy for powerful features like camera, fullscreen or payment. Use both for third-party content you don't control.
Why does my embed work here but not on my site?
Common causes: your page is HTTPS and the target is HTTP (mixed content), the target checks the Referer header, or your own site's Content-Security-Policy has a frame-src directive that doesn't include the target. Try the referrer-policy option in Frame options.
Is Iframe Viewer really free?
Yes — completely free, no account, no limits. It's a static site with no server costs to recover.