What's at Stake

An iframe is a whole page you didn't write, rendered inside one you did.

Embedded frames are how most sites handle the parts that matter most — the payment form, the sign-in widget, the consent banner, the support chat. Each one is a document from somebody else's origin, running its own code, with its own dependencies, changing on its own schedule. You cannot see inside it from your own page, and unless you are watching for it, you will not see when one is swapped, added, or pointed somewhere new.

Opaque by Design

You can't inspect a cross-origin frame from your page

The same-origin policy that keeps a third-party frame from reading your page also stops you reading it. Your own monitoring, your own error tracking, your own tests — none of them can see what is happening inside the frame your checkout depends on.

Quiet Substitution

A frame's source can change without anything looking different

An iframe pointed at a new host renders exactly like the old one. A payment form served from a lookalike domain looks like a payment form. Without an inventory to compare against, a substituted frame is invisible from the outside.

Inherited Dependencies

Frames arrive that nobody chose to add

Tag managers, ad networks and embedded widgets routinely insert frames of their own. A single approved embed can bring others with it, and those arrive without review, without a ticket, and without anyone on your team knowing they are there.

What Frame Watch Does

Continuous iframe inventory and change detection

Frame Watch maintains a live list of every iframe observed on your site and alerts you when a new one shows up. The data comes from real browser sessions, so it covers the frames that only appear at checkout or behind a login.

Frame Inventory

Every embedded document, catalogued automatically

Frame Watch records each iframe source your site loads, when it was first observed, when it was last seen, and how often it appears. No manual audit, no spreadsheet that goes stale the week after you build it — the inventory maintains itself from the reports your visitors' browsers already send.

Learn more about Frame Watch →

Change Detection

Alerted the first time a new frame is seen

When an iframe source appears that Frame Watch has not recorded before, it raises an alert with the source, the timestamp and the site it was seen on. You choose how sensitive that is: the alert threshold runs from one observation up to a hundred, so a busy site can wait for a pattern rather than hearing about every one-off.

Learn more about alert configuration →

Per-Site Monitoring

Watch the pages that matter, ignore the ones that don't

Each hostname is monitored separately, so your checkout and your marketing blog are tracked and alerted independently. Add exclusions to suppress URL prefixes you have already accounted for, route alerts to email or to a webhook, and keep the noise on the part of your estate where a new frame is genuinely worth a look.

Learn more about webhook alerts →

Get Started

Know every frame on your site. And the moment a new one appears.

One header. No code. Your iframe inventory starts populating from the first visitor.

Start Free Trial Talk to our team →

30-day free trial · One header · No code · Cancel anytime

Detection

Every observation, logged with context

Frame Watch is not an alert firehose. It records distinct observations about the frames on your site, each with the source, the timestamps and the monitored site it belongs to, so a notification tells you something specific rather than something vague.

What Frame Watch records	What it means
New iframe detected	A frame source is loading on your site that has not been observed before
First seen	When a given frame source entered your inventory
Last seen	Whether a frame is still in use, or quietly stopped loading
Observation frequency	How often the frame appears — separating a site-wide embed from a one-off
Monitored site	Which hostname the frame was seen on, so checkout and blog stay separate

This is the difference between “something new is on the site” and knowing exactly which frame, on which host, first seen when.

Architecture

Browser-native monitoring. No code. No crawlers.

Frame Watch reads the reports your visitors' browsers already send about what your pages load. Because the data comes from real sessions, it covers the frames a crawler would never reach — the ones that only render for signed-in users, in a specific region, or at the payment step.

You don't need a working CSP to start. A minimal report-only header is enough to begin building the inventory, and it blocks nothing.

Minimal setup — no existing CSP

Content-Security-Policy-Report-Only: default-src * 'unsafe-inline' 'unsafe-eval';
  connect-src 'self'; form-action 'self';
  report-uri https://your-subdomain.report-uri.com/r/d/csp/reportOnly

Already running a policy? Add your Report URI endpoint to the existing report-uri directive and Frame Watch begins populating from the reports you are already generating.

No code added to your pages

No crawler simulating page loads

Report-only mode blocks nothing while you monitor

Your site's performance is unaffected

Catches frames that only load in real flows — checkout, authenticated pages, geo-targeted content

PCI DSS 6.4.3

Frame Watch and payment page compliance

On most payment pages the card fields themselves live in an iframe from a payment service provider. PCI DSS 4.0.1 Requirement 6.4.3 asks you to know and justify what is loaded on those pages, and 11.6.1 asks you to detect unauthorised change to them. An iframe inventory with first-seen timestamps and a change log is exactly the sort of artefact both requirements are asking for.

Frame Watch covers the embedded documents. Script Watch covers the scripts, Data Watch covers where the page sends data, and the broader compliance evidence layer is set out on the PCI DSS Compliance page.

PCI DSS Compliance →

Scope

One layer in the stack. Here's how it fits.

Frame Watch tells you which iframes are on your site and when a new one turns up. It does not look inside them, and it does not block anything from loading — it is the embedded-document inventory layer, and it works alongside the rest.

Frame Watch does	Pairs with
Continuous iframe inventory	Script Watch for JavaScript — the same visibility for scripts rather than frames
Alerting on new frame sources	Data Watch for exfiltration monitoring — seeing where your pages send data
Per-host monitoring and exclusions	CSP for enforcement — restricting which frames are allowed to load at all
Historical audit trail	Threat Intelligence for IoC matching — telling you whether a new source is known bad

Together, these form the client-side security visibility layer that sits between your CSP policy and your incident response process.

Your payment form is an iframe. Do you know whose?