4 ms·
> I was surprised how much every website now tries to avoid/stop iframes due to the fact they aren't a "root" element. JS-based “iframe busters”, then X-Frame-
by tatersolid 7y ago
> I was surprised how much every website now tries to avoid/stop iframes due to the fact they aren't a "root" element.
JS-based “iframe busters”, then X-Frame-Options, and now Content-Security-Policy should be ubiquitous. We started “busting iframes” in they early 2000s in the banking industry for security reasons.
Preventing being an iframe child protects your site from phishing via click-jacking your login screen, and also prevents “stealing” of your content by spammy aggregation sites.