diff --git a/html/README.md b/html/README.md
index a85911a8a09f74..11e5bcf81c4069 100644
--- a/html/README.md
+++ b/html/README.md
@@ -17,3 +17,4 @@ For historical reasons, parts of HTML have their own directories:
 * [/websockets](/websockets)
 * [/webstorage](/webstorage)
 * [/workers](/workers)
+* [/x-frame-options](/x-frame-options)
diff --git a/x-frame-options/META.yml b/x-frame-options/META.yml
index 674a1648847c6a..21ef0699364f40 100644
--- a/x-frame-options/META.yml
+++ b/x-frame-options/META.yml
@@ -1,4 +1,5 @@
-spec: https://tools.ietf.org/html/rfc7034
+spec: https://html.spec.whatwg.org/#the-x-frame-options-header
 suggested_reviewers:
   - annevk
   - mikewest
+  - domenic
diff --git a/x-frame-options/README.md b/x-frame-options/README.md
index 7b35f0f1d14464..2fad3599d5cf2b 100644
--- a/x-frame-options/README.md
+++ b/x-frame-options/README.md
@@ -1,2 +1,3 @@
-This directory contains tests for
-[HTTP Header Field X-Frame-Options](https://tools.ietf.org/html/rfc7034).
+This directory contains tests for [`X-Frame-Options`](https://html.spec.whatwg.org/#the-x-frame-options-header).
+
+Currently it only tests `<iframe>`. It would be nice to test `<embed>` and `<object>` as well.
diff --git a/x-frame-options/deny.html b/x-frame-options/deny.html
new file mode 100644
index 00000000000000..90f65d3f439ff3
--- /dev/null
+++ b/x-frame-options/deny.html
@@ -0,0 +1,43 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>X-Frame-Options variations of DENY</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="./support/helper.sub.js"></script>
+
+<body>
+<script>
+"use strict";
+
+xfo_simple_tests({
+  headerValue: `DENY`,
+  sameOriginAllowed: false,
+  crossOriginAllowed: false
+});
+
+xfo_simple_tests({
+  headerValue: `denY`,
+  sameOriginAllowed: false,
+  crossOriginAllowed: false
+});
+
+xfo_simple_tests({
+  headerValue: `  DENY `,
+  sameOriginAllowed: false,
+  crossOriginAllowed: false
+});
+
+xfo_simple_tests({
+  headerValue: `DENY`,
+  cspValue: `default-src 'self'`,
+  sameOriginAllowed: false,
+  crossOriginAllowed: false
+});
+
+xfo_simple_tests({
+  headerValue: `DENY`,
+  cspValue: `frame-ancestors 'self'`,
+  sameOriginAllowed: true,
+  crossOriginAllowed: false
+});
+</script>
diff --git a/x-frame-options/deny.sub.html b/x-frame-options/deny.sub.html
deleted file mode 100644
index dd8afe8079a009..00000000000000
--- a/x-frame-options/deny.sub.html
+++ /dev/null
@@ -1,61 +0,0 @@
-<!DOCTYPE html>
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
-<script src="./support/helper.js"></script>
-<body>
-<script>
-  async_test(t => {
-    var i = document.createElement('iframe');
-    i.src = "./support/xfo.py?value=DENY";
-
-    assert_no_message_from(i, t);
-
-    i.onload = t.step_func_done(_ => {
-      assert_equals(i.contentDocument, null);
-      i.remove();
-    });
-
-    document.body.appendChild(i);
-  }, "`XFO: DENY` blocks same-origin framing.");
-
-  async_test(t => {
-    var i = document.createElement('iframe');
-    i.src = "http://{{domains[www]}}:{{ports[http][0]}}/x-frame-options/support/xfo.py?value=DENY";
-
-    assert_no_message_from(i, t);
-
-    i.onload = t.step_func_done(_ => {
-      assert_equals(i.contentDocument, null);
-      i.remove();
-    });
-
-    document.body.appendChild(i);
-  }, "`XFO: DENY` blocks cross-origin framing.");
-
-  async_test(t => {
-    var i = document.createElement('iframe');
-    i.src = "./support/xfo.py?value=DENY&csp_value=default-src%20'self'";
-
-    assert_no_message_from(i, t);
-
-    i.onload = t.step_func_done(_ => {
-      assert_equals(i.contentDocument, null);
-      i.remove();
-    });
-
-    document.body.appendChild(i);
-  }, "`XFO: DENY` blocks framing when CSP is present without a frame-ancestors directive.");
-
-  async_test(t => {
-    var i = document.createElement('iframe');
-    i.src = "./support/xfo.py?value=DENY&csp_value=frame-ancestors%20'self'";
-
-    wait_for_message_from(i, t)
-      .then(t.step_func_done(e => {
-        assert_equals(e.data, "Loaded");
-        i.remove();
-      }));
-
-    document.body.appendChild(i);
-  }, "`XFO: DENY` does not blocks framing when CSP is present with a frame-ancestors directive.");
-</script>
diff --git a/x-frame-options/get-decode-split.html b/x-frame-options/get-decode-split.html
new file mode 100644
index 00000000000000..9f5101d610eb28
--- /dev/null
+++ b/x-frame-options/get-decode-split.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>X-Frame-Options headers use the get, decode, and split algorithm</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="support/helper.sub.js"></script>
+
+<body>
+<script>
+"use strict";
+
+xfo_simple_tests({
+  headerValue: `,SAMEORIGIN,,DENY,`,
+  sameOriginAllowed: false,
+  crossOriginAllowed: false
+});
+
+xfo_simple_tests({
+  headerValue: `  SAMEORIGIN,    DENY`,
+  sameOriginAllowed: false,
+  crossOriginAllowed: false
+});
+</script>
diff --git a/x-frame-options/invalid.html b/x-frame-options/invalid.html
new file mode 100644
index 00000000000000..26b2905e4d44c2
--- /dev/null
+++ b/x-frame-options/invalid.html
@@ -0,0 +1,59 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>X-Frame-Options invalid values</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="./support/helper.sub.js"></script>
+
+<body>
+<script>
+"use strict";
+
+xfo_simple_tests({
+  headerValue: `INVALID`,
+  sameOriginAllowed: true,
+  crossOriginAllowed: true
+});
+
+xfo_simple_tests({
+  headerValue: `ALLOW-FROM https://example.com/`,
+  sameOriginAllowed: true,
+  crossOriginAllowed: true
+});
+
+xfo_simple_tests({
+  headerValue: `ALLOW-FROM=https://example.com/`,
+  sameOriginAllowed: true,
+  crossOriginAllowed: true
+});
+
+xfo_simple_tests({
+  headerValue: `ALLOWALL`,
+  sameOriginAllowed: true,
+  crossOriginAllowed: true
+});
+
+xfo_simple_tests({
+  headerValue: `"DENY"`,
+  sameOriginAllowed: true,
+  crossOriginAllowed: true
+});
+
+xfo_simple_tests({
+  headerValue: `"SAMEORIGIN"`,
+  sameOriginAllowed: true,
+  crossOriginAllowed: true
+});
+
+xfo_simple_tests({
+  headerValue: `"SAMEORIGIN,DENY"`,
+  sameOriginAllowed: true,
+  crossOriginAllowed: true
+});
+
+xfo_simple_tests({
+  headerValue: ``,
+  sameOriginAllowed: true,
+  crossOriginAllowed: true
+});
+</script>
diff --git a/x-frame-options/invalid.sub.html b/x-frame-options/invalid.sub.html
deleted file mode 100644
index 4604033d01fc2f..00000000000000
--- a/x-frame-options/invalid.sub.html
+++ /dev/null
@@ -1,84 +0,0 @@
-<!DOCTYPE html>
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
-<script src="./support/helper.js"></script>
-<body>
-<script>
-  async_test(t => {
-    var i = document.createElement('iframe');
-    i.src = "./support/xfo.py?value=INVALID";
-
-    wait_for_message_from(i, t)
-      .then(t.step_func_done(e => {
-        assert_equals(e.data, "Loaded");
-        i.remove();
-      }));
-
-    document.body.appendChild(i);
-  }, "`XFO: INVALID` allows same-origin framing.");
-
-  async_test(t => {
-    var i = document.createElement('iframe');
-    i.src = "http://{{domains[www]}}:{{ports[http][0]}}/x-frame-options/support/xfo.py?value=INVALID";
-
-    wait_for_message_from(i, t)
-      .then(t.step_func_done(e => {
-        assert_equals(e.data, "Loaded");
-        i.remove();
-      }));
-
-    document.body.appendChild(i);
-  }, "`XFO: INVALID` allows cross-origin framing.");
-
-  async_test(t => {
-    var i = document.createElement('iframe');
-    i.src = "./support/xfo.py?value=ALLOWALL";
-
-    wait_for_message_from(i, t)
-      .then(t.step_func_done(e => {
-        assert_equals(e.data, "Loaded");
-        i.remove();
-      }));
-
-    document.body.appendChild(i);
-  }, "`XFO: ALLOWALL` allows same-origin framing.");
-
-  async_test(t => {
-    var i = document.createElement('iframe');
-    i.src = "http://{{domains[www]}}:{{ports[http][0]}}/x-frame-options/support/xfo.py?value=ALLOWALL";
-
-    wait_for_message_from(i, t)
-      .then(t.step_func_done(e => {
-        assert_equals(e.data, "Loaded");
-        i.remove();
-      }));
-
-    document.body.appendChild(i);
-  }, "`XFO: ALLOWALL` allows cross-origin framing.");
-
-  async_test(t => {
-    var i = document.createElement('iframe');
-    i.src = "./support/xfo.py?value=";
-
-    wait_for_message_from(i, t)
-      .then(t.step_func_done(e => {
-        assert_equals(e.data, "Loaded");
-        i.remove();
-      }));
-
-    document.body.appendChild(i);
-  }, "Empty `XFO:` allows same-origin framing.");
-
-  async_test(t => {
-    var i = document.createElement('iframe');
-    i.src = "http://{{domains[www]}}:{{ports[http][0]}}/x-frame-options/support/xfo.py?value=";
-
-    wait_for_message_from(i, t)
-      .then(t.step_func_done(e => {
-        assert_equals(e.data, "Loaded");
-        i.remove();
-      }));
-
-    document.body.appendChild(i);
-  }, "Empty `XFO:` allows cross-origin framing.");
-</script>
diff --git a/x-frame-options/multiple.html b/x-frame-options/multiple.html
new file mode 100644
index 00000000000000..cc8d6e3fdaa272
--- /dev/null
+++ b/x-frame-options/multiple.html
@@ -0,0 +1,124 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>X-Frame-Options headers sent multiple times</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="support/helper.sub.js"></script>
+
+<body>
+<script>
+"use strict";
+
+xfo_simple_tests({
+  headerValue: `SAMEORIGIN`,
+  headerValue2: `SAMEORIGIN`,
+  sameOriginAllowed: true,
+  crossOriginAllowed: false
+});
+
+xfo_simple_tests({
+  headerValue: `SAMEORIGIN`,
+  headerValue2: `sameOrigin`,
+  sameOriginAllowed: true,
+  crossOriginAllowed: false
+});
+
+xfo_simple_tests({
+  headerValue: `SAMEORIGIN`,
+  headerValue2: `DENY`,
+  sameOriginAllowed: false,
+  crossOriginAllowed: false
+});
+
+xfo_simple_tests({
+  headerValue: `SAMEORIGIN`,
+  headerValue2: `INVALID`,
+  sameOriginAllowed: false,
+  crossOriginAllowed: false
+});
+
+xfo_simple_tests({
+  headerValue: `SAMEORIGIN`,
+  headerValue2: `ALLOWALL`, // same as INVALID
+  sameOriginAllowed: false,
+  crossOriginAllowed: false
+});
+
+xfo_simple_tests({
+  headerValue: `SAMEORIGIN`,
+  headerValue2: `"DENY"`, // same as INVALID
+  sameOriginAllowed: false,
+  crossOriginAllowed: false
+});
+
+xfo_simple_tests({
+  headerValue: `SAMEORIGIN`,
+  headerValue2: ``, // same as INVALID
+  sameOriginAllowed: false,
+  crossOriginAllowed: false
+});
+
+xfo_simple_tests({
+  headerValue: `DENY`,
+  headerValue2: `DENY`,
+  sameOriginAllowed: false,
+  crossOriginAllowed: false
+});
+
+xfo_simple_tests({
+  headerValue: `DENY`,
+  headerValue2: `INVALID`,
+  sameOriginAllowed: false,
+  crossOriginAllowed: false
+});
+
+xfo_simple_tests({
+  headerValue: `DENY`,
+  headerValue2: `ALLOWALL`, // same as INVALID
+  sameOriginAllowed: false,
+  crossOriginAllowed: false
+});
+
+xfo_simple_tests({
+  headerValue: `DENY`,
+  headerValue2: `"SAMEORIGIN"`, // same as INVALID
+  sameOriginAllowed: false,
+  crossOriginAllowed: false
+});
+
+xfo_simple_tests({
+  headerValue: `ALLOWALL`,
+  headerValue2: `INVALID`,
+  sameOriginAllowed: false,
+  crossOriginAllowed: false
+});
+
+xfo_simple_tests({
+  headerValue: `ALLOWALL`,
+  headerValue2: ``,
+  sameOriginAllowed: false,
+  crossOriginAllowed: false
+});
+
+xfo_simple_tests({
+  headerValue: `allowAll`,
+  headerValue2: `INVALID`,
+  sameOriginAllowed: false,
+  crossOriginAllowed: false
+});
+
+xfo_simple_tests({
+  headerValue: `INVALID`,
+  headerValue2: `INVALID`,
+  sameOriginAllowed: true,
+  crossOriginAllowed: true
+});
+
+xfo_simple_tests({
+  headerValue: `INVALID`,
+  headerValue2: ``,
+  sameOriginAllowed: true,
+  crossOriginAllowed: true
+});
+
+</script>
diff --git a/x-frame-options/multiple.sub.html b/x-frame-options/multiple.sub.html
deleted file mode 100644
index 717e9fd25c51ee..00000000000000
--- a/x-frame-options/multiple.sub.html
+++ /dev/null
@@ -1,87 +0,0 @@
-<!DOCTYPE html>
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
-<script src="./support/helper.js"></script>
-<body>
-<script>
-  async_test(t => {
-    var i = document.createElement('iframe');
-    i.src = "./support/xfo.py?value=SAMEORIGIN&value2=SAMEORIGIN";
-
-    wait_for_message_from(i, t)
-      .then(t.step_func_done(e => {
-        assert_equals(e.data, "Loaded");
-        i.remove();
-      }));
-
-    document.body.appendChild(i);
-  }, "`XFO: SAMEORIGIN; XFO: SAMEORIGIN` allows same-origin framing.");
-
-  async_test(t => {
-    var i = document.createElement('iframe');
-    i.src = "./support/xfo.py?value=SAMEORIGIN&value2=DENY";
-
-    assert_no_message_from(i, t);
-
-    i.onload = t.step_func_done(_ => {
-      assert_equals(i.contentDocument, null);
-      i.remove();
-    });
-
-    document.body.appendChild(i);
-  }, "`XFO: SAMEORIGIN; XFO: DENY` blocks same-origin framing.");
-
-  async_test(t => {
-    var i = document.createElement('iframe');
-    i.src = "./support/xfo.py?value=DENY&value2=SAMEORIGIN";
-
-    assert_no_message_from(i, t);
-
-    i.onload = t.step_func_done(_ => {
-      assert_equals(i.contentDocument, null);
-      i.remove();
-    });
-
-    document.body.appendChild(i);
-  }, "`XFO: DENY; XFO: SAMEORIGIN` blocks same-origin framing.");
-
-  async_test(t => {
-    var i = document.createElement('iframe');
-    i.src = "./support/xfo.py?value=INVALID&value2=SAMEORIGIN";
-
-    wait_for_message_from(i, t)
-      .then(t.step_func_done(e => {
-        assert_equals(e.data, "Loaded");
-        i.remove();
-      }));
-
-    document.body.appendChild(i);
-  }, "`XFO: INVALID; XFO: SAMEORIGIN` allows same-origin framing.");
-
-  async_test(t => {
-    var i = document.createElement('iframe');
-    i.src = "./support/xfo.py?value=SAMEORIGIN&value2=INVALID";
-
-    wait_for_message_from(i, t)
-      .then(t.step_func_done(e => {
-        assert_equals(e.data, "Loaded");
-        i.remove();
-      }));
-
-    document.body.appendChild(i);
-  }, "`XFO: SAMEORIGIN; XFO: INVALID` allows same-origin framing.");
-
-  async_test(t => {
-    var i = document.createElement('iframe');
-    i.src = "http://{{domains[www]}}:{{ports[http][0]}}/x-frame-options/support/xfo.py?value=SAMEORIGIN&value2=SAMEORIGIN";
-
-    assert_no_message_from(i, t);
-
-    i.onload = t.step_func_done(_ => {
-      assert_equals(i.contentDocument, null);
-      i.remove();
-    });
-
-    document.body.appendChild(i);
-  }, "`XFO: SAMEORIGIN; XFO: SAMEORIGIN` blocks cross-origin framing.");
-</script>
diff --git a/x-frame-options/redirect.html b/x-frame-options/redirect.html
new file mode 100644
index 00000000000000..65fd0d5dd1434d
--- /dev/null
+++ b/x-frame-options/redirect.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>X-Frame-Options headers sent along with a redirect</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="support/helper.sub.js"></script>
+
+<body>
+<script>
+"use strict";
+
+xfo_test({
+  url: `./support/redirect.py?value=DENY&url=/x-frame-options/support/xfo.py%3Fvalue%3DALLOWALL`,
+  check: "loaded message",
+  message: `XFO on redirect responses is ignored`
+});
+</script>
diff --git a/x-frame-options/redirect.sub.html b/x-frame-options/redirect.sub.html
deleted file mode 100644
index 0bc708b358cb30..00000000000000
--- a/x-frame-options/redirect.sub.html
+++ /dev/null
@@ -1,19 +0,0 @@
-<!DOCTYPE html>
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
-<script src="./support/helper.js"></script>
-<body>
-<script>
-  async_test(t => {
-    var i = document.createElement('iframe');
-    i.src = "./support/redirect.py?value=DENY&url=/x-frame-options/support/xfo.py%3Fvalue%3DALLOWALL";
-
-    wait_for_message_from(i, t)
-      .then(t.step_func_done(e => {
-        assert_equals(e.data, "Loaded");
-        i.remove();
-      }));
-
-    document.body.appendChild(i);
-  }, "XFO on redirect responses is ignored.");
-</script>
diff --git a/x-frame-options/sameorigin.sub.html b/x-frame-options/sameorigin.sub.html
index ede5446825995f..45f9b01bf156a4 100644
--- a/x-frame-options/sameorigin.sub.html
+++ b/x-frame-options/sameorigin.sub.html
@@ -1,86 +1,53 @@
 <!DOCTYPE html>
+<meta charset="utf-8">
+<title>X-Frame-Options variations of SAMEORIGIN</title>
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
-<script src="./support/helper.js"></script>
+<script src="./support/helper.sub.js"></script>
+
 <body>
 <script>
-  async_test(t => {
-    var i = document.createElement('iframe');
-    i.src = "./support/xfo.py?value=SAMEORIGIN";
-
-    wait_for_message_from(i, t)
-      .then(t.step_func_done(e => {
-        assert_equals(e.data, "Loaded");
-        i.remove();
-      }));
-
-    document.body.appendChild(i);
-  }, "`XFO: SAMEORIGIN` allows same-origin framing.");
-
-  async_test(t => {
-    var i = document.createElement('iframe');
-    i.src =
-      "./support/nested.py?origin=http://{{host}}:{{ports[http][0]}}&value=SAMEORIGIN&loadShouldSucceed=true";
-
-    wait_for_message_from(i, t)
-      .then(t.step_func_done(e => {
-        assert_equals(e.data, "Loaded");
-        i.remove();
-      }));
-
-    document.body.appendChild(i);
-  }, "`XFO: SAMEORIGIN` allows same-origin nested in same-origin framing.");
-
-  async_test(t => {
-    var i = document.createElement('iframe');
-    i.src = "http://{{domains[www]}}:{{ports[http][0]}}/x-frame-options/support/xfo.py?value=SAMEORIGIN";
-
-    assert_no_message_from(i, t);
-
-    i.onload = t.step_func_done(_ => {
-      assert_equals(i.contentDocument, null);
-      i.remove();
-    });
-
-    document.body.appendChild(i);
-  }, "`XFO: SAMEORIGIN` blocks cross-origin framing.");
-
-  async_test(t => {
-    var i = document.createElement('iframe');
-    i.src = "./support/nested.py?origin=http://{{domains[www]}}:{{ports[http][0]}}&value=SAMEORIGIN";
-
-    wait_for_message_from(i, t)
-      .then(t.step_func_done(e => {
-        assert_equals(e.data, "Failed");
-        i.remove();
-      }));
-
-    document.body.appendChild(i);
-  }, "`XFO: SAMEORIGIN` blocks cross-origin nested in same-origin framing.");
-
-  async_test(t => {
-    var i = document.createElement('iframe');
-    i.src = "http://{{domains[www]}}:{{ports[http][0]}}/x-frame-options/support/nested.py?origin=http://{{host}}:{{ports[http][0]}}&value=SAMEORIGIN";
-
-    wait_for_message_from(i, t)
-      .then(t.step_func_done(e => {
-        assert_equals(e.data, "Failed");
-        i.remove();
-      }));
-
-    document.body.appendChild(i);
-  }, "`XFO: SAMEORIGIN` blocks same-origin nested in cross-origin framing.");
-
-  async_test(t => {
-    var i = document.createElement('iframe');
-    i.src = "http://{{domains[www]}}:{{ports[http][0]}}/x-frame-options/support/nested.py?origin=http://{{domains[www]}}:{{ports[http][0]}}&value=SAMEORIGIN";
-
-    wait_for_message_from(i, t)
-      .then(t.step_func_done(e => {
-        assert_equals(e.data, "Failed");
-        i.remove();
-      }));
-
-    document.body.appendChild(i);
-  }, "`XFO: SAMEORIGIN` blocks cross-origin nested in cross-origin framing.");
+"use strict";
+
+xfo_simple_tests({
+  headerValue: `SAMEORIGIN`,
+  sameOriginAllowed: true,
+  crossOriginAllowed: false
+});
+
+xfo_simple_tests({
+  headerValue: `sameOriGin`,
+  sameOriginAllowed: true,
+  crossOriginAllowed: false
+});
+
+xfo_simple_tests({
+  headerValue: `  SAMEORIGIN `,
+  sameOriginAllowed: true,
+  crossOriginAllowed: false
+});
+
+xfo_test({
+  url: `./support/nested.py?origin=http://{{host}}:{{ports[http][0]}}&value=SAMEORIGIN&loadShouldSucceed=true`,
+  check: "loaded message",
+  message: `SAMEORIGIN allows same-origin nested in same-origin framing`
+});
+
+xfo_test({
+  url: `./support/nested.py?origin=http://{{domains[www]}}:{{ports[http][0]}}&value=SAMEORIGIN`,
+  check: "failed message",
+  message: `SAMEORIGIN blocks cross-origin nested in same-origin framing`
+});
+
+xfo_test({
+  url: `http://{{domains[www]}}:{{ports[http][0]}}/x-frame-options/support/nested.py?origin=http://{{host}}:{{ports[http][0]}}&value=SAMEORIGIN`,
+  check: "failed message",
+  message: `SAMEORIGIN blocks same-origin nested in cross-origin framing`
+});
+
+xfo_test({
+  url: `http://{{domains[www]}}:{{ports[http][0]}}/x-frame-options/support/nested.py?origin=http://{{domains[www]}}:{{ports[http][0]}}&value=SAMEORIGIN`,
+  check: "failed message",
+  message: `SAMEORIGIN blocks cross-origin nested in cross-origin framing`
+});
 </script>
diff --git a/x-frame-options/support/helper.js b/x-frame-options/support/helper.js
deleted file mode 100644
index 2932a0a7fb00f0..00000000000000
--- a/x-frame-options/support/helper.js
+++ /dev/null
@@ -1,13 +0,0 @@
-function assert_no_message_from(frame, test) {
-  wait_for_message_from(frame, test)
-    .then(test.unreached_func("Frame should not have sent a message."));
-}
-
-function wait_for_message_from(frame, test) {
-  return new Promise((resolve, reject) => {
-    window.addEventListener("message", test.step_func(e => {
-      if (e.source == frame.contentWindow)
-        resolve(e);
-    }));
-  });
-}
diff --git a/x-frame-options/support/helper.sub.js b/x-frame-options/support/helper.sub.js
new file mode 100644
index 00000000000000..23663dd2d07236
--- /dev/null
+++ b/x-frame-options/support/helper.sub.js
@@ -0,0 +1,104 @@
+function xfo_simple_tests({ headerValue, headerValue2, cspValue, sameOriginAllowed, crossOriginAllowed }) {
+  simpleXFOTestsInner({
+    urlPrefix: "",
+    allowed: sameOriginAllowed,
+    headerValue,
+    headerValue2,
+    cspValue,
+    sameOrCross: "same-origin"
+  });
+
+  simpleXFOTestsInner({
+    urlPrefix: "http://{{domains[www]}}:{{ports[http][0]}}",
+    allowed: crossOriginAllowed,
+    headerValue,
+    headerValue2,
+    cspValue,
+    sameOrCross: "cross-origin"
+  });
+}
+
+function simpleXFOTestsInner({ urlPrefix, allowed, headerValue, headerValue2, cspValue, sameOrCross }) {
+  const value2QueryString = headerValue2 !== undefined ? `&value2=${headerValue2}` : ``;
+  const cspQueryString = cspValue !== undefined ? `&csp_value=${cspValue}` : ``;
+
+  const valueMessageString = headerValue === "" ? "(the empty string)" : headerValue;
+  const value2MessageString = headerValue2 === "" ? "(the empty string)" : headerValue2;
+  const value2MaybeMessageString = headerValue2 !== undefined ? `;${headerValue2}` : ``;
+  const cspMessageString = cspValue !== undefined ? ` with CSP ${cspValue}` : ``;
+
+  // This will test the multi-header variant, if headerValue2 is not undefined.
+  xfo_test({
+    url: `${urlPrefix}/x-frame-options/support/xfo.py?value=${headerValue}${value2QueryString}${cspQueryString}`,
+    check: allowed ? "loaded message" : "no message",
+    message: `\`${valueMessageString}${value2MaybeMessageString}\` ${allowed ? "allows" : "blocks"} ${sameOrCross} framing${cspMessageString}`
+  });
+
+  if (headerValue2 !== undefined && headerValue2 !== headerValue) {
+    // Reversed variant
+    xfo_test({
+      url: `${urlPrefix}/x-frame-options/support/xfo.py?value=${headerValue2}&value2=${headerValue}${cspQueryString}`,
+      check: allowed ? "loaded message" : "no message",
+      message: `\`${value2MessageString};${valueMessageString}\` ${allowed ? "allows" : "blocks"} ${sameOrCross} framing${cspMessageString}`
+    });
+
+    // Comma variant
+    xfo_test({
+      url: `${urlPrefix}/x-frame-options/support/xfo.py?value=${headerValue},${headerValue2}${cspQueryString}`,
+      check: allowed ? "loaded message" : "no message",
+      message: `\`${valueMessageString},${value2MessageString}\` ${allowed ? "allows" : "blocks"} ${sameOrCross} framing${cspMessageString}`
+    });
+
+    // Comma + reversed variant
+    xfo_test({
+      url: `${urlPrefix}/x-frame-options/support/xfo.py?value=${headerValue2},${headerValue}${cspQueryString}`,
+      check: allowed ? "loaded message" : "no message",
+      message: `\`${value2MessageString},${valueMessageString}\` ${allowed ? "allows" : "blocks"} ${sameOrCross} framing${cspMessageString}`
+    });
+  }
+}
+
+function xfo_test({ url, check, message }) {
+  async_test(t => {
+    const i = document.createElement("iframe");
+    i.src = url;
+
+    switch (check) {
+      case "loaded message": {
+        waitForMessageFrom(i, t).then(t.step_func_done(e => {
+          assert_equals(e.data, "Loaded");
+        }));
+        break;
+      }
+      case "failed message": {
+        waitForMessageFrom(i, t).then(t.step_func_done(e => {
+          assert_equals(e.data, "Failed");
+        }));
+        break;
+      }
+      case "no message": {
+        waitForMessageFrom(i, t).then(t.unreached_func("Frame should not have sent a message."));
+        i.onload = t.step_func_done(() => {
+          assert_equals(i.contentDocument, null);
+        });
+        break;
+      }
+      default: {
+        throw new Error("Bad test");
+      }
+    }
+
+    document.body.append(i);
+    t.add_cleanup(() => i.remove());
+  }, message);
+}
+
+function waitForMessageFrom(frame, test) {
+  return new Promise(resolve => {
+    window.addEventListener("message", test.step_func(e => {
+      if (e.source == frame.contentWindow) {
+        resolve(e);
+      }
+    }));
+  });
+}
