How to check if website is loadable in iframe

Question

I need to check, if website in iframe is loaded properly. On my website, users can POST custom website, which will show them in iframe. But some websites are protected from insert to iframe (such as google or facebook).

How can I check, if is website loadable in iframe and can be used in iframe?

PS: I haven't show any code, because I have no code and no idea how to do it. (My website runs on Java, so no Apache or PHP).

Trstram

See this: https://mcmap.net/q/244899/-detect-x-frame-options – Disclosure

possible duplicate of Detect X-Frame-Options – Autobahn

BTW, how can you flag this as duplicate, when I am not running on PHP? – Sulphur

Answer 1

Check HTTP response header for X-Frame-Options. Facebook sends X-Frame-Options=DENY, which means "The page cannot be displayed in a frame, regardless of the site attempting to do so."

The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a <frame>, <iframe> or <object>. Sites can use this to avoid clickjacking attacks, by ensuring that their content is not embedded into other sites.

Check this: Accessing the web page's HTTP Headers in JavaScript

Dissimilarity

No. You need to check the Headers the website sends you. You can use get_headers. Or do you want javascript? #220731 – Innocency

Sorry, I forgot to say, that my website runs on Java. I have no Apache or PHP. – Sulphur

+1. This is a perfectly fit answer to the question. Why the downvote? In fact it is the question which is unclear. – Disclosure

mkyong.com/java/how-to-get-http-response-header-in-java for Java, or the stackoverflow answer I linked above if you want to do this dynamically in js. – Innocency

There's also JS, which is much simpler, that can undo iframes: if ( location.href != parent.location.href ) { parent.location.href = location.href; } How do you check for that? – Haifa

@abhitalks I didn't downvote... Thanks guys, I will try all possibilities. – Sulphur

This generally wouldn't work in JavaScript, which is what I think the questioner is actually asking about because the request would probably be denied due to Access Control Allow Origin restrictions. I'm not sure there is a good answer to this question. But this one definitely isn't one. – Bigford