Header Controller

Iframe lab

These overrides apply only in this lab tab to requests at the entered URL's origin, including its subresources. They override saved rules for these headers, independently of the global switch, until replaced, cleared or the tab is closed. Values are temporary and are not saved. Other origins and redirected destinations keep their existing rules.

Uncheck for sites that reject sandboxed frames, then reopen or reload the frame. Without sandbox restrictions, the site may open popups or navigate this tab subject to Chrome's normal rules. Browser security and the site's embedding policies still apply.

Requested URL: none

Ready. This workspace creates a real iframe.

A load event cannot confirm rendering. A blank or refused frame may be caused by X-Frame-Options, CSP frame-ancestors, a network error or site logic. Use Diagnostics to identify the cause. Cross-origin redirects and the final URL cannot be read by this page.

The embedded site can run scripts and submit forms. When sandbox is enabled, it restricts top navigation and popups; sites requiring those features may behave differently. No response security headers are removed.