What a Chrome extension can and cannot rewrite in a response
Manifest V3 removed blocking webRequest. declarativeNetRequest can strip a response header. In our measurement, one rule condition missed page-created frames.
SecurityClickjacking, the attack that framing headers exist to stop
A transparent iframe over a decoy button steals a real click. Here is the attack step by step, the defenses ranked strongest first, and why a frame-buster is the weakest.
EmbeddingWhy a site logs you out inside an iframe
Open framing headers are not enough. SameSite, third-party cookie blocking, and partitioned cookies decide whether a framed app keeps you logged in.
Embeddingframe-ancestors: the directive that decides who may frame you
The CSP directive that replaced X-Frame-Options. Its source list syntax, why it wins when both headers disagree, and the four mistakes that make it useless.
EmbeddingThe headers that tell a server it is being framed
A browser tells every server how a request was made. Sec-Fetch-Dest says iframe, and a server can refuse on that alone, with no CSP and no X-Frame-Options.
AdvancedWhat six iframes actually cost your browser
A cross-site frame runs in a different process from the page that embeds it. Here is where the memory goes, what lazy loading defers, and how to measure it on your own machine.
SecurityEvery iframe sandbox token, and what it lets through
An empty sandbox attribute removes almost every capability. Here is each token, what it restores, and the two combinations that quietly undo the whole thing.
EmbeddingCamera, microphone, and clipboard inside an iframe
A cross-origin frame gets no camera and no microphone unless the parent hands them over. Here is how the allow attribute and the header fit, plus the Chromium-only clipboard.
EmbeddingpostMessage is the only safe way to talk to a frame
A cross-origin frame will not hand you its document. postMessage is the one channel that crosses, and it is safe only if you name an exact target origin and check event.origin.
EmbeddingWhy a reverse proxy does not really solve iframe blocking
Rewriting a site through your own domain strips the framing headers. It also breaks the login, mixes up the cookies, and puts you somewhere you probably should not be.
EmbeddingWhy Gmail and Google Calendar never load in an iframe
The DENY we measured came from Google's sign-in page, not the mailbox. Here is the whole redirect chain, why no extension or proxy fixes it, and what Google does embed.
EmbeddingX-Frame-Options, the header that started it all
Two values still work, and a third never did. Here is what DENY and SAMEORIGIN really do, why ALLOW-FROM failed, why an unknown value fails open, and what replaced it.
ComparisonThe best start pages in 2026
An honest look at the start pages and dashboard tools worth using in 2026 — what each one is actually for, what the free tiers include, and how to pick.
TipsGmail and Google Calendar side by side
Google's side panel, a second window, or a dashboard launcher: three honest ways to keep Gmail and Calendar in view at once, and what Google won't embed.
ComparisonTulipLot vs start.me: widgets and links, or live sites?
start.me builds a start page from bookmarks and widgets. TulipLot renders a fixed grid of real sites, live. How the two differ, and what each one costs.
ComparisonTulipLot vs Toby: which one fits how you actually work?
Toby saves tabs you reopen later. TulipLot keeps a fixed grid of sites live at once. An honest look at both, with prices and free-plan limits.
ComparisonTulipLot vs Workona: project spaces or a live grid?
Workona sorts tabs into per-project spaces with sync. TulipLot keeps a fixed grid of sites rendered live. What each one is for, and what each one costs.
TipsHow to view multiple websites at once
Five ways to see two or more websites at the same time: split screen, browser windows, extensions, and a fixed dashboard grid. When each is the right call.
ProductWhat is a browser start page (and do you still need one)?
Start pages, home pages, and new-tab pages are three different things. Here's what each one does, why iGoogle's descendants keep dying, and what replaced them.
TipsFive ways to lay out a productive dashboard
Five field-tested ways to lay out a six-cell dashboard — by role, by rhythm, and by attention — plus the placement rules that make any layout stick.
ProductWhy we built TulipLot
Tab overload is a workflow problem, not a willpower problem. Why we think a fixed grid beats a wall of tabs — and what we deliberately left out.