Making User-Generated Sites Embeddable: X-Frame-Options vs CSP Frame-Ancestors

If you let users publish something, such as a page, prototype, or dashboard, sooner or later you want an “embed this” button so they can drop it into a blog, a portfolio, or docs, the way a CodePen result embeds. Then you ship the iframe, and it renders a blank box: refused to connect . The reflex is to blame the iframe.