Let’s say you don’t want other sites to “frame” your site in an <iframe>: So you insert anti-framing, frame busting JavaScript into all your pages: Excellent! Now you “bust” or break out of any containing iframe automatically. Except for one small problem. As it turns out, your frame-busting code can be busted, as shown here: This code does the following: