# Can a web site detect and deny an attempt to use it in an iframe?

**URL:** <https://boards.straightdope.com/t/can-a-web-site-detect-and-deny-an-attempt-to-use-it-in-an-iframe/830222>\
**Category:** Factual Questions\
**Created:** [February 26, 2019, 3:48am UTC](https://boards.straightdope.com/t/can-a-web-site-detect-and-deny-an-attempt-to-use-it-in-an-iframe/830222 "2019-02-26T03:48:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![CookingWithGas](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cookingwithgas/32/485_2.png) [@CookingWithGas](https://boards.straightdope.com/u/CookingWithGas)\
**Post date:** [February 26, 2019, 3:48am UTC](https://boards.straightdope.com/t/can-a-web-site-detect-and-deny-an-attempt-to-use-it-in-an-iframe/830222/1 "2019-02-26T03:48:52Z")

</div>

I built a web page for myself that uses iframes to show the schedule pages for several music venues I follow, so I can have them all on one page. Today I am getting a “refused to connect” error on one of them even though I can open that site in its own tab.

Can a site detect inclusion in an iframe vs. any other page request, and deny it?

---

<div class="post-metadata">

**Author:** ![ZipperJJ](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zipperjj/32/211_2.png) [@ZipperJJ](https://boards.straightdope.com/u/ZipperJJ)\
**Post date:** [February 26, 2019, 4:06am UTC](https://boards.straightdope.com/t/can-a-web-site-detect-and-deny-an-attempt-to-use-it-in-an-iframe/830222/2 "2019-02-26T04:06:36Z")

</div>

Yes. The x-frame-options header [X-Frame-Options - HTTP | MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options)

---

<div class="post-metadata">

**Author:** ![BigT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bigt/32/12044_2.png) [@BigT](https://boards.straightdope.com/u/BigT)\
**Post date:** [February 26, 2019, 5:14pm UTC](https://boards.straightdope.com/t/can-a-web-site-detect-and-deny-an-attempt-to-use-it-in-an-iframe/830222/3 "2019-02-26T17:14:30Z")

</div>

I note that both [Firefox](https://addons.mozilla.org/en-US/firefox/addon/ignore-x-frame-options-header/) and [Chrome](https://chrome.google.com/webstore/detail/ignore-x-frame-headers/gleekbfjekiniecknbkamfmkohkpodhe?hl=en-US) have addons that will override this security feature.

Chrome has a feature now where you can enable the addon only on certain pages. I would try enabling it only on the webpage of the site that doesn’t work in the iframe. That way you don’t override this security feature on every page.

---

<div class="post-metadata">

**Author:** ![CookingWithGas](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cookingwithgas/32/485_2.png) [@CookingWithGas](https://boards.straightdope.com/u/CookingWithGas)\
**Post date:** [March 31, 2019, 3:56pm UTC](https://boards.straightdope.com/t/can-a-web-site-detect-and-deny-an-attempt-to-use-it-in-an-iframe/830222/4 "2019-03-31T15:56:54Z")

</div>

> [@BigT](#):
>
> I note that both [Firefox](https://addons.mozilla.org/en-US/firefox/addon/ignore-x-frame-options-header/) and [Chrome](https://chrome.google.com/webstore/detail/ignore-x-frame-headers/gleekbfjekiniecknbkamfmkohkpodhe?hl=en-US) have addons that will override this security feature.
> 
> Chrome has a feature now where you can enable the addon only on certain pages. I would try enabling it only on the webpage of the site that doesn’t work in the iframe. That way you don’t override this security feature on every page.

I finally got around to doing this and it works like a charm. It never would have even occurred to me to look for such a thing. Thank you very much!