Frame Opener – Remove X-Frame-Options & CSP to Embed Any Site in an Iframe

Frame any website, without the framing restrictions getting in your way.

Frame Opener removes X-Frame-Options and Content-Security-Policy headers from the sites you visit, allowing pages to be embedded inside an iframe without restrictions.

Whether you’re a developer testing iframe integrations, a designer previewing sites in dashboards, or a power user who needs to frame external content, this extension gives you full control — with a one-click toggle to turn it off the moment you’re done.

Features

• Removes X-Frame-Options headers automatically.
• Strips CSP frame-ancestors and frame-src restrictions.
• Toggle on or off from the popup or dashboard, instantly.
• Built-in frame tester — preview any URL inside an iframe immediately.
• Lightweight session rules — no background processes running constantly.
• On-page indicator — a brief, non-intrusive marker shows when frame protection is affected.

No complex setup. Install, toggle on, and frame any website.

How It Works

The extension uses Chrome’s declarativeNetRequest API to intercept responses and remove two specific headers: X-Frame-Options and Content-Security-Policy. Without them, the browser no longer refuses to display the site inside an iframe on another origin.

A session rule is applied globally, and you can disable it at any time via the popup or dashboard. A content script shows a brief, non-intrusive indicator when frame protection is active on a page, so you always know what state you’re in.

Who It’s For

• Web developers testing cross-origin iframe integrations.
• UI/UX designers building dashboards or widget previews.
• QA engineers verifying third-party embeds.
• Power users who need to frame content from sites that block framing.
• Anyone working with web proxies, portals, or internal tools that display external pages.

Why Framing Gets Blocked in the First Place

X-Frame-Options and the CSP frame-ancestors directive exist for a reason: they stop clickjacking, where a malicious page invisibly layers a real site (your bank, your email) inside a frame and tricks you into clicking things you can’t see. That’s why most serious sites refuse to be framed at all.

The catch is that the same protection blocks entirely legitimate work. You can’t preview a client’s live site in a design dashboard, can’t test how a partner’s widget renders in your portal, and can’t build an internal tool that surfaces external pages — even when you own both ends of the integration. Frame Opener lets you lift the restriction on demand, do the work, and put it back with one click.

Responsible Use — Please Read

This extension disables a real security control, and it does so globally across every site you visit while it’s toggled on. That matters:

• Toggle it on only while you’re actively testing, and switch it off when you’re finished. The one-click toggle and session-scoped rules exist precisely so this is easy.
• Don’t browse with it on. With framing protection removed, a malicious page could frame sites you’re logged into — which is exactly the attack X-Frame-Options was written to prevent.
• Consider a dedicated browser profile for development work, so your everyday browsing and logged-in accounts are never exposed.
• This is a development and testing tool. It isn’t a way to bypass a site’s wishes about being embedded in production, and framing someone else’s content publicly may raise legal and terms-of-service issues regardless of what your browser allows.

Used the way it’s intended — on, test, off — it’s a genuinely useful part of a web development workflow.

Frequently Asked Questions

What does Frame Opener do? It removes the X-Frame-Options and Content-Security-Policy headers from responses, so pages that normally refuse to be framed can be embedded in an iframe for testing and previewing.

Why do sites block iframes by default? To prevent clickjacking — an attack where a malicious page hides a real site inside an invisible frame and tricks you into clicking things. X-Frame-Options and CSP frame-ancestors are the defenses against it.

Is it safe to leave enabled all the time? No, and it isn’t meant to be. Because it removes framing protection globally while active, you should toggle it on for testing and off when you’re done. Many users run it in a separate development browser profile.

Which headers does it remove? X-Frame-Options, plus the CSP frame-ancestors and frame-src restrictions that control framing.

How do I turn it off? One click from the popup or the dashboard. Rules are session-scoped, so nothing lingers in the background.

What is the frame tester? A built-in tool that lets you paste any URL and preview it inside an iframe instantly — so you can check framing behavior without wiring up a test page first.

Does it run constantly in the background? No. It uses lightweight session rules via the declarativeNetRequest API rather than a persistent background process.

Will this let me embed any site on my public website? It only changes what your browser accepts — visitors to your site would still be blocked by the target’s headers. It’s a local development and testing tool, not a production workaround, and embedding others’ content publicly can raise legal and terms-of-service issues.

Install Frame Opener, test your iframe integrations without fighting headers — and toggle it back off when you’re done.