Clickjacking Protection Tester
Check pasted headers for clickjacking protection.
Runs in your browser. Nothing is uploaded — your input is processed on this device and discarded when you close the tab.
Clickjacking Protection Tester
How to use this tool
- Enter your values in the fields above.
- Press Generate to see the result.
- Use Load sample to try the worked example, Copy result to copy it, or Clear to start again.
Worked example
Pasting X-Frame-Options DENY and frame-ancestors 'none' reports protection present on both checks.
What this tool does not do / Limits
Only pasted headers are read. This does not test a live site, and headers alone do not prove every page on a site is protected.
Frequently asked questions
Which header is better?
CSP frame-ancestors is the modern control; X-Frame-Options is older but still useful. Having either in the pasted headers counts as protection here.
Does this test my live site?
No. Paste the headers yourself; this tool never contacts a site.
Related tools
JSON Studio
Format, validate, minify, query and compare JSON in your browser, with precise line-and-column errors.
LiveRegex Tester
Test patterns against sample text with match highlighting, capture groups and a safe one-second timeout.
LiveSecurity Header and DNS Checker
Check HSTS, CSP and other security headers, TLS details, and DNS/email authentication records (SPF, DKIM, DMARC).
Live