UNFRAME

iframe blockade breaker · edge proxy

IDLE

target url

test targets:

AWAITING TARGET

paste any url above — X-Frame-Options & Content-Security-Policy get stripped in transit.
press / to focus the input

01target02strip blockers03embed

BREACHING FRAME BLOCKADE…

Your browser never touches the target directly. A Cloudflare Pages Function fetches it server-side.
The response comes back with its cage removed: x-frame-options, content-security-policy (incl. report-only), cross-origin-* and permissions-policy headers are deleted.
Inside the HTML, inline frame-buster scripts (if (top !== self)…) and meta-CSP tags are cut out.
A <base href> tag is injected so images, CSS and JS still resolve against the real origin.
The cleaned document is piped into the iframe. The iframe is sandboxed without allow-top-navigation, so anything the regex missed still can't hijack your tab.

Anti-bot walls. Cloudflare/Akamai/PerimeterX challenges recognize the edge IP and serve a checkpoint instead of the page.
Logged-in content. Cookies are not bridged through the proxy, so anything behind auth won't work.
Heavy SPAs. Apps that hardcode absolute API origins with strict CORS, or rely on service workers, degrade or fail.
WebSockets & live streams generally don't survive the hop.

Use this on content you have the right to display. Stripping headers does not grant redistribution rights — many sites' terms prohibit framing.

your-repo/
├─ index.html          ← this page
└─ functions/
   └─ proxy.js         ← the header-stripping proxy

Create a GitHub repo containing exactly those two files.
Cloudflare dashboard → Workers & Pages → Create → Pages → Connect to Git → pick the repo.
Build settings: framework preset None · build command (leave empty) · build output directory /
Deploy. Your app is live at https://<project>.pages.dev — the /functions folder automatically becomes the /proxy endpoint.
Free tier covers 100,000 function requests/day. CLI alternative: npx wrangler pages deploy . --project-name unframe