Allow embedding

If your site allows it, players press Play and your game loads inside Alldle’s page. If it refuses, the button opens your site in a new tab. Both are counted, and your listing is the same either way, so this is your call.

Are you allowed in a frame today?

Alldle reads your response headers the way a browser does:

Your site sends	Result
No framing header at all	Allowed
Content-Security-Policy: frame-ancestors naming https://www.alldle.net	Allowed
Content-Security-Policy: frame-ancestors 'self', or a list without Alldle	Refused
X-Frame-Options: DENY or SAMEORIGIN, with no frame-ancestors	Refused

frame-ancestors replaces X-Frame-Options when both are there, so a site that sends SAMEORIGIN along with a list naming Alldle is allowed.

To see your own headers:

curl -sI https://your-game.example | grep -iE 'frame-options|content-security-policy'

The header to send

The clean option is to name Alldle and nobody else. Both addresses matter: alldle.net alone does not cover www.alldle.net.

Content-Security-Policy: frame-ancestors 'self' https://www.alldle.net https://alldle.net

Remove any X-Frame-Options header you were sending, which some frameworks and hosts add for you.

Cloudflare / Netlify

In a file named _headers at the root of what you publish:

_headers

/*
  Content-Security-Policy: frame-ancestors 'self' https://www.alldle.net https://alldle.net

Vercel

vercel.json

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        {
          "key": "Content-Security-Policy",
          "value": "frame-ancestors 'self' https://www.alldle.net https://alldle.net"
        }
      ]
    }
  ]
}

nginx

add_header Content-Security-Policy "frame-ancestors 'self' https://www.alldle.net https://alldle.net" always;

Express

app.use((req, res, next) => {
  res.setHeader(
    'Content-Security-Policy',
    "frame-ancestors 'self' https://www.alldle.net https://alldle.net",
  );
  next();
});

SvelteKit

src/hooks.server.ts

export async function handle({ event, resolve }) {
  const response = await resolve(event);
  response.headers.set(
    'content-security-policy',
    "frame-ancestors 'self' https://www.alldle.net https://alldle.net",
  );
  return response;
}

Note

A <meta> tag cannot set frame-ancestors: browsers ignore it there. It has to be a real response header. GitHub Pages does not let you set headers, but it sends none that block framing.

When Alldle checks

Alldle checks your headers when you add a game, during its review, and when you change its address. It re-checks live games from time to time, and a game that has started refusing frames is switched to opening in a new tab.

Nothing turns the frame back on by itself. If you have fixed your headers on a game that opens in a new tab, write to us and we will switch it back.

A site that was down or timed out during a check is not marked as refusing. Only a real answer counts.

What changes inside a frame

The frame has these permissions, which cover what a browser game normally does:

sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox allow-downloads"
allow="fullscreen; autoplay; clipboard-write"

So keep these in mind:

• Copying a result works, through clipboard-write.
• Your game cannot navigate the top page. Redirecting window.top is blocked. Links that open a new tab work.
• Saved progress can be separate. Browsers keep a site’s storage apart when it is framed by another site. A player’s localStorage inside Alldle is usually not the one they have on your site, so a streak kept there starts fresh.
• Third-party cookies are often blocked. A login that relies on them may not work in the frame. Offer play without an account, or send players to your site for that.
• Your layout gets a smaller box. Check it at phone width.

To test, open your game’s page on Alldle once it is live, or put it in an <iframe> on a local page and open that page. A frame on another site will be refused until your header allows that site too.

Your ads and analytics

They keep running, because it is your page in the frame. Ad networks vary in how they treat framed pages, so check your own numbers after turning this on.