Tool
Frameability checker
Check whether a URL can be loaded in an iframe, which header is refusing, and how to allow or refuse framing on purpose.
Traffic exchanges, rotators and surf engines show member sites inside an iframe. A site that refuses to be framed appears as a dead blank panel: the visitor waits out the timer, the advertiser paid for nothing, and nobody can see why.
It is worth checking both directions. If you run a site that takes exchange traffic, you want this to say yes. If you run the exchange, probe member sites and route the refusers to a managed window instead of a frame.
The check is a HEAD request reading two headers. Nothing is loaded or rendered.
Notes
There is no permissive value for X-Frame-Options. DENY and SAMEORIGIN both refuse an exchange, and anything else is ignored or treated as DENY depending on the browser. To allow framing you send the header not at all.
CSP frame-ancestors overrides X-Frame-Options where both are understood, so a site can look frameable by one header and refuse by the other. This checks both.
Hosting panels and security plugins add these headers without being asked, which is the usual reason a site refuses framing when its own code never set anything.
Unreachable is not a refusal. When probing in bulk, leave unreachable sites as they were rather than flagging them.