The following code does not work. How does Facebook do it? Is there any way around this?
<html> <head></head> <body> <iframe src="http://www.facebook.com" width="500" height="500"> </iframe> </body> </html>
This is because they have <meta http-equiv="X-Frame-Options" content="deny" />at their source.
<meta http-equiv="X-Frame-Options" content="deny" />
They do this to avoid fraud and flipping. This is impossible to do. This is a security feature that won't go anywhere ...