X-Frame-Options Tester
Check whether a page is protected against clickjacking: via the X-Frame-Options header or the modern CSP frame-ancestors directive. Checked from Uptimeify's EU servers.
What watches these brands watches your clients too
End the manual growth tax.
Running checks by hand eats valuable agency time. Uptimeify monitors your entire client portfolio from one place: on a fair, organization-wide quota model, on secure EU infrastructure. No per-client fees, no surprises.
Frequently asked questions about X-Frame-Options Tester
Clickjacking tricks a user into clicking something on your site by loading it invisibly inside a frame on an attacker's page. You prevent it by telling browsers not to allow framing: the older X-Frame-Options header (DENY or SAMEORIGIN) or, preferably, the Content-Security-Policy frame-ancestors directive, which is more flexible and not deprecated.
The request runs on Uptimeify's EU servers, and the domain you enter is used only for the test and is not stored. The fetcher only allows http and https and refuses to connect to private or internal addresses. As an EU-built, EU-hosted provider, we keep this off US infrastructure and clear of US Cloud Act exposure, which matters for agencies handling client data under GDPR.
Security headers are often dropped by a misconfigured deploy or a new CDN rule, silently weakening protection. Verify the page here, then let Uptimeify watch the site continuously and alert you the moment its response, headers included, changes unexpectedly.
Ready to Keep Verifying That Protection?
A header test is valid for the moment you ran it. Uptimeify keeps checking that the page answers, redirects cleanly to HTTPS and serves the content you defined, reporting every deviation.