It's worth pointing out that you can replace the functionality of the X-Frame-Options header with Content-Security-Policy using the frame-ancestors directive if

It's worth pointing out that you can replace the functionality of the X-Frame-Options header with Content-Security-Policy using the frame-ancestors directive if you want to: https://scotthelme.co.uk/csp-cheat-sheet/#frame-ancestors https://scotthelme.co.uk/csp-cheat-sheet/#frame-ancestors A world with opt-in to unsafe behaviour would be great, but a long way off I fear. Thanks for mentioning the header check service!