X-Frame-OptionsBaseline · Widely available
The X-Frame-Options HTTP header limits where a document may be embedded in an iframe. The X-Frame-Options: SAMEORIGIN header disallows embedding in another origin. The X-Frame-Options: DENY header disallows embedding in any context, regardless of origin.
Supported in all major browsers for at least 30 months — safe to use without fallbacks. Baseline since Jul 29, 2015. Widely available since Jan 29, 2018.
Browser support
DesktopChrome
1–3Not supported
4+Supportedsince Jan 25, 2010
Current: 155Edge
12+Supportedsince Jul 29, 2015
Current: 154Firefox
1–3.6Not supported
4+Supportedsince Mar 22, 2011
Current: 157Safari
1–3.1Not supported
4+Supportedsince Jun 8, 2009
Current: 27MobileChrome Android
18+Supportedsince Jun 27, 2012
Current: 155Firefox Android
4+Supportedsince Mar 29, 2011
Current: 157Safari iOS
1–3Not supported
3.2+Supportedsince Apr 3, 2010
Current: 27How to use
This feature is Baseline widely available — use it freely, no fallback needed.
Example
Full syntax and examples are on MDN: X-Frame-Options.
Feature detection
There’s no simple runtime check for this feature; rely on the support table and test in your target browsers.
Documentation (MDN)
Specification
Sub-features
Support for each part of the feature (3). The overall table above shows when the whole feature works.
| Sub-feature | Chrome | Edge | Firefox | Safari | Chrome Android | Firefox Android | Safari iOS |
|---|---|---|---|---|---|---|---|
| http.headers.X-Frame-Options | 4 | 12 | 4 | 4 | 18 | 4 | 3.2 |
| http.headers.X-Frame-Options.DENY | 4 | 12 | 4 | 4 | 18 | 4 | 3.2 |
| http.headers.X-Frame-Options.SAMEORIGIN | 4 | 12 | 4 | 4 | 18 | 4 | 3.2 |