frame-ancestors
The Content-Security-Policy directive that lists which origins may show a page inside a frame, replacing the older X-Frame-Options header. CrawlCheck uses frame-ancestors 'none' on its own sensitive pages and, when checking a site's embeds, treats a list that leaves the page's origin out as a frame the visitor will not see.
What frame-ancestors does not show
It controls framing only; it says nothing about whether the framed content is correct or current.
Where frame-ancestors comes up on this site
- CSP report-only: how to roll out a Content-Security-Policy without breaking your siteThe grammar is directives separated by semicolons, each naming a resource class and the sources allowed for it: script-src , style-src , img-src , connect-src , frame-ancestors and so on, with default-src as the fallback for any class not named.
Terms this definition uses
Content-Security-Policy · X-Frame-Options
Definitions that name frame-ancestors
Related terms in Security and privacy
Where an agent, a tool or a page can be turned against its operator, and the controls that limit the damage without proving safety.
X-Frame-Options · Referrer-Policy · Permissions-Policy · Encrypted Client Hello · lookalike domain · homoglyph · incident switch · high-risk field · Indirect prompt injection · Direct prompt injection · Jailbreak · Data exfiltration · Sensitive information disclosure · Secret leakage · Insecure output handling · Excessive agency · Least privilege · Trust boundary · Input validation · Output validation · Allowlist · Denylist · SSRF · RCE · Credential scope · OAuth scope · API key · Bearer token · mTLS · Rate-limit policy · Audit log · PII · Data minimization · Purpose limitation · Retention period · Data residency · Tenant isolation · Threat model · DMARC · DMARC alignment · SPF · DKIM · MTA-STS · TLS-RPT · CAA record · DNSSEC · hard bounce
Questions about frame-ancestors
What is frame-ancestors?
The Content-Security-Policy directive that lists which origins may show a page inside a frame, replacing the older X-Frame-Options header. CrawlCheck uses frame-ancestors 'none' on its own sensitive pages and, when checking a site's embeds, treats a list that leaves the page's origin out as a frame the visitor will not see.
What does frame-ancestors not show or guarantee?
CrawlCheck uses frame-ancestors 'none' on its own sensitive pages and, when checking a site's embeds, treats a list that leaves the page's origin out as a frame the visitor will not see. It controls framing only; it says nothing about whether the framed content is correct or current.
Which area of the glossary does frame-ancestors belong to?
Security and privacy: Where an agent, a tool or a page can be turned against its operator, and the controls that limit the damage without proving safety.
← X-Frame-Options · Referrer-Policy →
See it in the full glossary · 772 terms across 19 areas.
Free browser extension
See this on any site you visit, in one click.
CrawlCheck for Chrome grades every site you visit A–F and shows, from your own browser, what search engines and AI assistants are actually served. Free, no account.