WPT
wpt / x-frame-options / deny.html
Spec: https://html.spec.whatwg.org/multipage/browsing-the-web.html#the-x-frame-options-header ↗
Runs: Chrome 155.0.8039.0 (wpt@6ec9fd59f, 2026-09-03) | Firefox 157.0a1 (wpt@6ec9fd59f, 2026-09-03) | Safari 251 preview (wpt@5ce815a83, 2026-08-27) | Ladybird 1.0-795e1 (wpt@7e3d005d7, 2026-09-03) | Servo Servo 0.6 (wpt@09159dcb3, 2026-09-02) | Blitz 188486089 (wpt@a95401e4e, 2026-09-02)
View on the Blitz WPT dashboard | Open test on wpt.live | wpt.fyi
| Chrome | Firefox | Safari | Ladybird | Servo | Blitz | |
|---|---|---|---|---|---|---|
| Total | 10/10 | 10/10 | 10/10 | 10/10 | 10/10 | NOT RUN |
| Subtest | Chrome | Firefox | Safari | Ladybird | Servo | Blitz |
|---|---|---|---|---|---|---|
| `DENY` blocks same-origin framing | PASS | PASS | PASS | PASS | PASS | — |
| `DENY` blocks cross-origin framing | PASS | PASS | PASS | PASS | PASS | — |
| `denY` blocks same-origin framing | PASS | PASS | PASS | PASS | PASS | — |
| `denY` blocks cross-origin framing | PASS | PASS | PASS | PASS | PASS | — |
| ` DENY ` blocks same-origin framing | PASS | PASS | PASS | PASS | PASS | — |
| ` DENY ` blocks cross-origin framing | PASS | PASS | PASS | PASS | PASS | — |
| `DENY` blocks same-origin framing with CSP default-src 'self' | PASS | PASS | PASS | PASS | PASS | — |
| `DENY` blocks cross-origin framing with CSP default-src 'self' | PASS | PASS | PASS | PASS | PASS | — |
| `DENY` allows same-origin framing with CSP frame-ancestors 'self' | PASS | PASS | PASS | PASS | PASS | — |
| `DENY` blocks cross-origin framing with CSP frame-ancestors 'self' | PASS | PASS | PASS | PASS | PASS | — |