or not set, the iframe's content will not execute JavaScript, and won't allow top-level navigation. By specifying in the space separated set of exceptions in the value, the iframe will allow JavaScript, but will still disallow top-level navigation, rendering framekillers in the iframe impotent. See also Clickjacking - discusses more sophisticated methods to prevent embedding in a frame, such as X-Frame-Options header References HTML