Type any URL — your own app, a login screen, an internal tool, anything — and load it below in a real <iframe> to check whether it renders or gets blocked by X-Frame-Options / CSP frame-ancestors. A blank or refused frame means it's blocked — browsers don't expose a script-readable reason why, so this is a visual test, not an automated pass/fail.
A hosted flow sends visitors to a separate sign-in page. A direct flow starts from the app. Either page may block being shown inside a frame; use the examples below to compare redirects, popups, and hidden-frame requests.