Can You Embed app.onepassapps.com? The Frame, Opener and Permission Headers on 56 Pages

I work on OnePassApps, and this is our own site's behaviour, measured today, 10 November 2026: one plain GET for each of the 56 URLs in our sitemap, from one network, signed out, with no browser open.

The question developers ask most often about a site like ours is simple: can somebody else's page put ours in an iframe? The header answer is no. All 56 of our pages answer with X-Frame-Options: SAMEORIGIN, which means only a page served from our own origin may frame us.

The Content-Security-Policy header agrees with it: the same directive appears in the policy on all 56 responses - frame-ancestors 'self' - so the restriction is written twice, in two different header families.

Two isolation headers ride along with it: Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin. The first decides what a page you opened from ours may do with our window; the second decides what other sites may read from our resources.

There is no Cross-Origin-Embedder-Policy header on any of the 56 responses. The pages are therefore not cross-origin isolated, and the two headers above are isolation for the window and for the resources, not for the whole document.

The Permissions-Policy header is the same string on all 56 responses and it names 10 features: accelerometer=(), autoplay=(self), camera=(), encrypted-media=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(self), payment=(), usb=().

display-capture is not among them, so that header does not switch the screen-capture feature off for our pages. Camera and microphone are named, though: camera=() denies camera access outright and microphone=(self) allows the microphone only to a page on our own origin.

The last of the security set is Referrer-Policy: no-referrer, which asks the browser to send no Referer header at all when a request leaves our pages, and X-Content-Type-Options: nosniff, which stops a browser from guessing a different content type for what we serve.

Put in one line, the isolation set our 56 pages carry is: SAMEORIGIN; same-origin; same-origin; no-referrer; nosniff; accelerometer=(), autoplay=(self), camera=(), encrypted-media=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(self), payment=(), usb=().

What this does not claim: I did not frame a page in a real iframe, so nothing here is a statement about what a browser does when it tries. This is what the headers say, on one build, on one day, from one network, with no cookie and no account.

If you want the pages themselves, they are at https://app.onepassapps.com/?utm_source=devto&utm_medium=community&utm_campaign=frame-policy-layer&utm_content=home-link

The app guides are at https://app.onepassapps.com/guides?utm_source=devto&utm_medium=community&utm_campaign=frame-policy-layer&utm_content=guides-link