Wondering if there's a way to detect a page load was done inside a frame, iframe, etc. (likely via JavaScript) and if so, what are the limits of such a detection system?

if (top.location.href != window.location.href) {
     alert("In A Frame");

The limit is if JavaScript is turned off it won't work.

You can also use the X-Frame-Options HTTP header. This header tells a web browser whether or not to allow a web page to be framed in another web page. This includes <frame> and <iframe> tags.

There are two possible values for this header:

DENY - This setting prevents any pages served from being placed in a frame even if it is on the same website it originates from. should be used if you never intend for your pages to be used inside of a frame.

SAMEORIGIN - This setting allows pages to be served in a frame of a page on the same website. If an external site attempts to load the page in a frame the request will be denied.

This header works in Internet Explorer 8.0, Firefox 3.6.9, Opera 10.50, Safari 4.0, and Chrome 4.1.

  • @blunder, No problem. Try using the header I just added, too, as it is a better way to do it and will compliment the JavaScript code nicely. (Assuming you are trying to block the content from being loaded in a frame that is). – John Conde Mar 23 '11 at 14:03
  • Thanks, John -- I had wondered if there was a header based detection system, selecting you as the answer. Cheers! – blunders Mar 23 '11 at 14:59
  • Note that the X-Frame-Options header may prevent some legitimate services such as Google Translate from working. See the following for further info: webmasters.stackexchange.com/questions/31287/… – snap Jul 14 '12 at 8:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.