---
title: "Refuse to be framed · Agent Wranglers"
url: https://agentwranglers.se/playbook/website/security/frame-ancestors
updated: 2026-10-20
licence: "All rights reserved"
---

# Refuse to be framed

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Security](https://agentwranglers.se/playbook/website/security)
- Rule: Stop other sites from showing yours inside a frame. Use `frame-ancestors 'none'` (or a list) in the CSP, plus `X-Frame-Options` for older browsers.
- How: Add `frame-ancestors 'none'` to the CSP and send `X-Frame-Options: DENY`. If partners must embed you, list their origins instead.
- Check: Embedding the site in an `iframe` elsewhere shows nothing.

Example:

```http
Content-Security-Policy: frame-ancestors 'none'
X-Frame-Options: DENY
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/security/frame-ancestors`.

- Previous: [Stop browsers guessing file types](https://agentwranglers.se/playbook/website/security/x-content-type-options)
- Next: [Refuse odd requests from other sites](https://agentwranglers.se/playbook/website/security/fetch-metadata)
- [Security](https://agentwranglers.se/playbook/website/security)