The two main response headers
X-Frame-Options can deny framing or restrict it to the same origin. Content-Security-Policy frame-ancestors can allow an explicit list. An external preview tool cannot override these server policies.
Authentication and third-party cookies
An embeddable page may still appear signed out because of SameSite cookies, third-party-cookie controls or cross-origin authentication. Payment and identity pages are intentionally stricter.
A quick diagnosis
- Open the URL directly in a normal tab
- Check the console for frame or CSP messages
- Inspect response security headers
- Verify the tool with a page you control
If you control the target site
Allow only the preview origins you genuinely need. If embedding is inappropriate, use a deployment preview URL, real-browser testing or a controlled screenshot service instead.