Can I embed this site in an iframe?

A browser refuses to put a page inside an iframe when the page sends X-Frame-Options, or a Content-Security-Policy with a frame-ancestors directive that leaves your origin out. This table shows the raw value that each site sends today.

What this does not tell you

A header read proves one thing only: the browser permits the frame. It does not prove that the application works inside one. A login cookie with SameSite=Lax fails in a third-party frame even when the framing headers are open. The "Usable in practice" column therefore stays empty for any app that nobody tried by hand. An empty cell means "not tested". It never means "probably fine".

There is a second limit, and it matters just as much. An unauthenticated request measures whatever page it lands on, and for a site that requires a login, that is often a sign-in screen and not the application itself. Our Gmail request, for example, never reached mail.google.com — it landed on accounts.google.com, Google's own sign-in page. Some hosts also answer differently from one request to the next. Outlook Web sent frame-ancestors 'self' teams.microsoft.com on three fetches in a row, then sent no framing header at all on two later fetches from the same script. Read every row below as a snapshot taken on the date above, not as a permanent fact about the site.

How we test

One GET request to each address, with a current Chrome user agent, and redirects followed. The script reads two response headers and writes the raw values to a JSON file that ships with the site. Repeat it yourself:

cd frontend && npm run probe:embed

The next run is due 2026-11-24. Headers change, so a row that is more than a quarter old deserves a fresh check.