Frame-Ancestors Directive is a Content Security Policy directive that controls which origins may embed a page in a frame, iframe or object. It is checked by the browser to reduce clickjacking and unauthorised framing, unlike older frame-busting script techniques.
How Frame-Ancestors Directive Works
The frame-ancestors directive is a browser-enforced CSP control that defines which origins may embed a page inside a frame, iframe, or object. It is evaluated at render time, so its protection comes from the user agent rather than from page JavaScript.
That matters because embedding is often invisible to the user. By deciding who may frame the page, the directive blocks unauthorized presentation of a trusted interface inside an attacker-controlled shell. Unlike frame-busting scripts, it is much harder to bypass because it is enforced by the browser’s policy engine.
Why It Matters for Clickjacking Defense
Clickjacking works when an attacker overlays or disguises a framed page so that a user believes they are interacting with the attacker’s content while actually clicking on the trusted site. Frame-ancestors reduces that exposure by limiting where the page can appear.
The control is especially important for pages that perform sensitive actions, such as changing account settings, approving transactions, or confirming destructive operations. For a practical overview of this attack class and the defensive patterns around it, see the Clickjacking Guide.
It also fits into a broader browser hardening strategy. Framing rules work alongside other HTTP security headers, and they are usually stronger than legacy approaches that try to detect framing after the page loads. The wider header set is covered in the Security Headers Guide.
How It Relates to Other Browser Controls
Frame-ancestors is part of CSP, so it should be understood as one piece of a larger policy model rather than a standalone fix. It complements other cross-origin controls by narrowing where a document may be embedded, while separate policies govern script loading, navigation, storage, and cross-origin interactions.
It is also more precise than older frame controls because it can express allowlists that support legitimate partner embedding without opening the page to arbitrary framing. The Content Security Policy Guide explains how frame-ancestors fits into a strict CSP rollout, including report-only testing and enforcement.
When framing is only one part of a broader browser attack surface, related issues such as cross-site leaks and embed-based information disclosure can still matter. The XS-Leaks Guide is useful context for understanding how browsers can reveal information even when direct script access is blocked.
Deployment and Compatibility Considerations
In practice, frame-ancestors must be deployed carefully because it can block legitimate integrations. Organisations that allow partner portals, embedded widgets, or administrative consoles inside third-party surfaces need to define expected embedding relationships explicitly rather than relying on permissive defaults.
It is also important to test the policy across browsers and application paths that render the same page in different contexts. The strongest deployments are validated with real framing tests, because a control that is syntactically correct but mis-scoped can create false confidence.
For pages that intentionally support iframe use cases, sandboxing and origin isolation matter as well. The Iframe Sandboxing and srcdoc Security Guide helps when you need to reason about safe embedded content, opaque origins, and the difference between allowed embedding and allowed interaction.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP ASVS and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V12 — Secure Communication | Frame-ancestors is an application browser-policy control that protects page interaction in transit and embedding context. |
| V15 — Secure Coding and Architecture | Embedding constraints are an architectural defense that should be designed into page delivery and trust boundaries. | |
| Recommendation — Require a strict CSP that blocks unauthorized framing and validate it during web security testing. Design sensitive pages to refuse arbitrary embedding and document any approved partner frame relationships. | ||
| NIST SP 800-53 Rev 5 | SC-18 — Mobile Code | CSP framing restrictions help constrain how browser-delivered content is rendered and interacted with. |
| SC-8 — Transmission Confidentiality and Integrity | Preventing unauthorized embedding supports integrity of user interactions with sensitive web content. | |
| Recommendation — Apply browser-content restrictions to reduce hostile framing and UI redress exposure. Protect sensitive web interactions from being recontextualized inside attacker-controlled frames. | ||