Why some websites won't load inside another page

The blank box

If you have ever tried to show google.com inside an iframe, you got an empty rectangle and a console error along the lines of “refused to display in a frame”. Nothing is broken on your side. The site told your browser not to show it there.

Many tools that promise to put several websites on one screen quietly fail for exactly this reason: the big sites people care about most all say no.

What the header does

Every response from a web server carries headers. Two of them control framing. X-Frame-Options (with DENY or SAMEORIGIN) is the older one. Content-Security-Policy with a frame-ancestors rule is the modern one, and it can name exactly which sites may embed the page.

The browser enforces both. The embedding page cannot override them with code, and no setting on your own site changes them, because the rule belongs to the site being embedded.

Why sites do this

The main reason is clickjacking. An attacker loads a real site invisibly inside their own page and tricks you into clicking a button you cannot see — approving a payment, changing a setting, posting something. Sites that handle logins, money or private conversations block framing so that cannot happen.

That is why search engines, AI chatbots, social networks and code hosts block it. It is a deliberate protection for their users.

What works instead

Some content is made to be embedded. YouTube refuses to frame its normal pages, but its official embed player is designed for it, and so is Twitch’s. That is how Stream Multi-View plays video inside a page.

For everything else, use real browser windows. Frame blocking only applies to content shown inside another page, not to a window of its own. Ask Everywhere opens ChatGPT, Claude, Gemini and others in separate windows and tiles them across your screen, so you still get a side-by-side view.

A word of caution on “unblockers”

Some services offer to strip these headers by routing a site through their own server. That means your logins and conversations pass through a stranger’s machine, it usually breaks sign-in, and it defeats the protection the site put there for your benefit. It is not worth the risk for a chatbot or an email account.