This page is standing in for an attacker's site. It is trying to embed the demo page in an iframe — the setup behind every clickjacking attack.
Framing: /demo/advanced.php?csp=frame-ancestors-absent
checking…
Try with frame-ancestors absent Try with frame-ancestors 'none' Back to the demo
Note that frame-ancestors is enforced by the framed
page, not by this one — and that it does not inherit from
default-src. A policy of default-src 'self' leaves
you fully frameable.