Left is intentionally framable; right is protected. Point the
clickjacking checker at either one to see the
difference — the framable page renders, the protected one stays blank.
victim.html — framable
No anti-framing headers → renders in any frame. Test it →
protected.html — protected
X-Frame-Options: DENY + frame-ancestors 'none' → stays blank. Test it →