# TulipLot

> TulipLot is a browser dashboard that shows up to six live websites side by side in a fixed 3×2 grid, in one browser tab.

## Facts
- Try: 2 usable cells, no account. Free: 5 usable cells + 1 ad cell, $0. Premium: 6 cells, no ad, $4/month.
- Most sites embed live. Some need the optional TulipLot Companion (a Chrome extension). A few never embed and open in their own tab from the grid.
- Chrome-first. Public site: https://tuliplot.com/

## Guides
- [Getting started with TulipLot](https://tuliplot.com/guides/getting-started/): Create your account, build your first 3×2 grid, and learn every cell control — a complete five-minute setup guide for your TulipLot browser dashboard.
- [Adding sites that refuse to be framed](https://tuliplot.com/guides/add-any-site/): Why some sites show "refused to connect" in a dashboard, and how the TulipLot Companion extension unlocks them safely, one site at a time.
- [Premium vs Free — what you get](https://tuliplot.com/guides/premium-vs-free/): Everything the free plan includes, exactly what $4/month adds, and what happens to your grid when you upgrade, downgrade, or cancel.
- [Why some sites won't load in a dashboard](https://tuliplot.com/guides/why-sites-wont-load/): "Refused to connect" isn't a bug in your dashboard. Here's what that message actually means, which sites do it, and what can and can't be done about it.

## Blog
- [What a Chrome extension can and cannot rewrite in a response](https://tuliplot.com/blog/chrome-declarativenetrequest-headers/): Manifest V3 removed blocking webRequest. declarativeNetRequest can strip a response header. In our measurement, one rule condition missed page-created frames.
- [Clickjacking, the attack that framing headers exist to stop](https://tuliplot.com/blog/clickjacking-explained/): A transparent iframe over a decoy button steals a real click. Here is the attack step by step, the defenses ranked strongest first, and why a frame-buster is the weakest.
- [Why a site logs you out inside an iframe](https://tuliplot.com/blog/cookies-inside-an-iframe/): Open framing headers are not enough. SameSite, third-party cookie blocking, and partitioned cookies decide whether a framed app keeps you logged in.
- [frame-ancestors: the directive that decides who may frame you](https://tuliplot.com/blog/csp-frame-ancestors/): The CSP directive that replaced X-Frame-Options. Its source list syntax, why it wins when both headers disagree, and the four mistakes that make it useless.
- [The headers that tell a server it is being framed](https://tuliplot.com/blog/fetch-metadata-headers/): A browser tells every server how a request was made. Sec-Fetch-Dest says iframe, and a server can refuse on that alone, with no CSP and no X-Frame-Options.
- [What six iframes actually cost your browser](https://tuliplot.com/blog/iframe-performance-cost/): A cross-site frame runs in a different process from the page that embeds it. Here is where the memory goes, what lazy loading defers, and how to measure it on your own machine.
- [Every iframe sandbox token, and what it lets through](https://tuliplot.com/blog/iframe-sandbox-attribute/): An empty sandbox attribute removes almost every capability. Here is each token, what it restores, and the two combinations that quietly undo the whole thing.
- [Camera, microphone, and clipboard inside an iframe](https://tuliplot.com/blog/permissions-policy-in-frames/): A cross-origin frame gets no camera and no microphone unless the parent hands them over. Here is how the allow attribute and the header fit, plus the Chromium-only clipboard.
- [postMessage is the only safe way to talk to a frame](https://tuliplot.com/blog/postmessage-between-frames/): A cross-origin frame will not hand you its document. postMessage is the one channel that crosses, and it is safe only if you name an exact target origin and check event.origin.
- [Why a reverse proxy does not really solve iframe blocking](https://tuliplot.com/blog/reverse-proxy-embedding/): Rewriting a site through your own domain strips the framing headers. It also breaks the login, mixes up the cookies, and puts you somewhere you probably should not be.
- [Why Gmail and Google Calendar never load in an iframe](https://tuliplot.com/blog/why-google-apps-never-embed/): The DENY we measured came from Google's sign-in page, not the mailbox. Here is the whole redirect chain, why no extension or proxy fixes it, and what Google does embed.
- [X-Frame-Options, the header that started it all](https://tuliplot.com/blog/x-frame-options-explained/): Two values still work, and a third never did. Here is what DENY and SAMEORIGIN really do, why ALLOW-FROM failed, why an unknown value fails open, and what replaced it.
- [The best start pages in 2026](https://tuliplot.com/blog/best-start-pages-2026/): An honest look at the start pages and dashboard tools worth using in 2026 — what each one is actually for, what the free tiers include, and how to pick.
- [Gmail and Google Calendar side by side](https://tuliplot.com/blog/gmail-and-calendar-side-by-side/): Google's side panel, a second window, or a dashboard launcher: three honest ways to keep Gmail and Calendar in view at once, and what Google won't embed.
- [TulipLot vs start.me: widgets and links, or live sites?](https://tuliplot.com/blog/tuliplot-vs-start-me/): start.me builds a start page from bookmarks and widgets. TulipLot renders a fixed grid of real sites, live. How the two differ, and what each one costs.
- [TulipLot vs Toby: which one fits how you actually work?](https://tuliplot.com/blog/tuliplot-vs-toby/): Toby saves tabs you reopen later. TulipLot keeps a fixed grid of sites live at once. An honest look at both, with prices and free-plan limits.
- [TulipLot vs Workona: project spaces or a live grid?](https://tuliplot.com/blog/tuliplot-vs-workona/): Workona sorts tabs into per-project spaces with sync. TulipLot keeps a fixed grid of sites rendered live. What each one is for, and what each one costs.
- [How to view multiple websites at once](https://tuliplot.com/blog/view-multiple-websites-at-once/): Five ways to see two or more websites at the same time: split screen, browser windows, extensions, and a fixed dashboard grid. When each is the right call.
- [What is a browser start page (and do you still need one)?](https://tuliplot.com/blog/what-is-a-browser-start-page/): Start pages, home pages, and new-tab pages are three different things. Here's what each one does, why iGoogle's descendants keep dying, and what replaced them.
- [Five ways to lay out a productive dashboard](https://tuliplot.com/blog/dashboard-productivity-tips/): Five field-tested ways to lay out a six-cell dashboard — by role, by rhythm, and by attention — plus the placement rules that make any layout stick.
- [Why we built TulipLot](https://tuliplot.com/blog/why-we-built-tuliplot/): Tab overload is a workflow problem, not a willpower problem. Why we think a fixed grid beats a wall of tabs — and what we deliberately left out.

## Pages
- [Home](https://tuliplot.com/): TulipLot is a browser dashboard that shows up to six live websites side by side in a fixed 3×2 grid, in one browser tab.
- [Try TulipLot without an account](https://tuliplot.com/try/): Two live cells with no signup; they move into a free account when you create one.
- [About TulipLot](https://tuliplot.com/about/): Why TulipLot exists, how it works, and what Try, Free, and Premium include.
- [Changelog](https://tuliplot.com/changelog/): What changed on TulipLot, newest first: features, fixes, and content updates.
- [Guides](https://tuliplot.com/guides/): Step-by-step help: your first grid, sites that refuse to embed, and Premium vs Free.
- [Can I embed this site in an iframe?](https://tuliplot.com/can-i-embed/): A measured table of X-Frame-Options and CSP frame-ancestors for 60 popular web apps, with the raw header values and the test date.
- [Blog](https://tuliplot.com/blog/): Tab overload, browser dashboards, comparisons, and product news.
- [Contact](https://tuliplot.com/contact/): How to reach Dmytro Korniienko, who runs TulipLot: which address to use for support, billing, feedback, or a privacy request, and the reply time to expect.
- [Privacy Policy](https://tuliplot.com/privacy/): What TulipLot collects, how the ad cell and cookies work, how long data is kept, how to delete your account, and the rights you have over your data.
- [Terms of Service](https://tuliplot.com/terms/): The terms that govern TulipLot: accounts, the free and Premium plans, acceptable use, disclaimer and liability, changes, and how to contact us.

## Contact
- https://tuliplot.com/contact/