JavaScript FrameBuster Snippet

Discussion

1. Isiah

   Sorry bit of a jacascript noob here – this sounds great but how would one implement it? Where does it go?

   Again apologies for what must sound a simple question.
• Eric

  Just toss it at the top of your javascript file :). Really anywhere in your JS this would work.
• Emilio

  Just don’t put it inside a function unless that your intention. For example if for some reason you want to give your users a chance to make sure the page isn’t iframed by clicking a button then you put that code in a function say unIFrameMe() and then call that function when onclick the button.

  In general, you’ll want this code to be outside of a function, so it is run when the js is loaded.

  EMILIO!
2. Petah

   But what about the Frame Buster Buster?

   http://stackoverflow.com/questions/958997/frame-buster-buster-buster-code-needed
3. Isiah

   Thanks for the answers re the javascript.

   htaccess solutions might be better as they are not so easily bypassed:

   To blocks all sites (including your own) from iframing your pages:

   Header append X-FRAME-OPTIONS "DENY"
   

   or to block any external site from iframing your pages:

   Header append X-FRAME-OPTIONS "SAMEORIGIN"
   
4. Drew

   You can also only block some of your urls with the x-frame-options header. Here’s an apache solution

   Header always append X-Frame-Options SAMEORIGIN # Block any site from applying an iframe.
5. Drew

   Apparently I didn’t use `pre` tags.

   Header always append X-Frame-Options SAMEORIGIN # Block any site from applying an iframe.