DiggBar: How to Disable or Block It (and Stop Framing Today)

The diggbar was a toolbar Digg added in April 2009 that wrapped other people’s websites in a frame on Digg. Many bloggers wanted it gone. This guide covers how users turned it off and how site owners blocked it back then, plus the modern way to stop any site from framing your pages.

Quick answer: The DiggBar no longer exists, so there is nothing left to block. In 2009, users could switch it off in Digg’s settings, and site owners broke out of it with JavaScript frame-busting code, PHP referrer checks or WordPress plugins. Today, the reliable way to stop other sites from framing your pages is the Content-Security-Policy frame-ancestors header.

What was the diggbar?

The DiggBar let you Digg a story, read comments, find related content and share pages from anywhere on the web. But it did this by framing websites and blogs: the page you clicked loaded inside a frame under a Digg toolbar, with a Digg short URL in the address bar.

Why did so many people block it? TechCrunch reported concerns that the DiggBar was keeping all Digg homepage traffic on Digg instead of sending it to the sites that were dugg. Digg said it had fixed the SEO issues and webmaster concerns, but some concerns remained. Digg itself has since changed owners and been relaunched more than once, and the DiggBar is long gone. For the full background, read our Digg story from 2005 to 2012.

How users disabled the DiggBar in 2009

1. Digg settings: if you were a Digg user, you could turn the DiggBar off in your Digg viewing preferences.
2. Greasemonkey: Firefox users could install Greasemonkey and a “Remove Digg bar” userscript to stop the toolbar appearing.

How site owners blocked the DiggBar

1. JavaScript frame-busting

BloggingTips explained how a small frame-breaker script in your page’s <head> would work. The visitor still saw the Digg toolbar for a second before it was removed, and they had to click Back twice to return to Digg. It did not work in browsers with JavaScript turned off.

<script type="text/javascript">
if (top !== self) top.location.href = self.location.href;
</script>

Farukat.es shared a version that only broke out of Digg frames and used location.replace so the Back button kept working. Wikipedia’s framekiller article showed another variant that told visitors why they were being redirected with an alert box.

2. PHP referrer check

Daring Fireball explained how to block the DiggBar with a few lines of PHP. The code checked whether the HTTP referrer looked like a DiggBar URL; if so, it printed a special message for Digg users and stopped the rest of the page from loading. It did not block all visitors from Digg, only those coming through the DiggBar.

3. WordPress plugins

The No Frames plugin detected frames and broke your site free so visitors saw the full page. It has not been updated in many years, so use the header method below instead.

How to stop sites framing your pages today

JavaScript frame-busting is easy to get around. Modern browsers support a better method: send a response header from your server.

• Block all framing: Content-Security-Policy: frame-ancestors 'none';
• Allow only your own site: Content-Security-Policy: frame-ancestors 'self';
• Older browsers: X-Frame-Options: DENY or SAMEORIGIN does a similar job.

According to MDN’s frame-ancestors reference, this directive does not work in a <meta> tag, so set it in your server config, CDN or a security plugin. Test that your own embeds, previews and page builders still work afterwards. It fits well with the other steps in our server security guide.

FAQ

Does the DiggBar still exist?

No. The DiggBar was removed long ago, so you don’t need any code to block it.

Why did bloggers block the DiggBar?

It framed their pages under Digg’s toolbar and short URLs, and critics worried it kept traffic on Digg instead of sending it to the original sites.

What is the best way to stop my site being framed?

Send the Content-Security-Policy header with frame-ancestors ‘none’ or ‘self’ from your server.

Can I set frame-ancestors in a meta tag?

No. Browsers ignore frame-ancestors in a meta tag; it must be sent as an HTTP header.