diff --git a/atom/browser/default_app/index.html b/atom/browser/default_app/index.html
index 1a689d8a6b33..df6001242836 100644
--- a/atom/browser/default_app/index.html
+++ b/atom/browser/default_app/index.html
@@ -62,8 +62,6 @@
   </style>
 </head>
 <body>
-  <iframe src="http://google.com"></iframe>
-  <iframe src="http://baidu.com"></iframe>
   <script>
     var execPath = require('remote').process.execPath;
     var command = execPath + ' path-to-your-app';
diff --git a/docs/api/browser-window.md b/docs/api/browser-window.md
index be6357eb9ef9..0e75e86a51ff 100644
--- a/docs/api/browser-window.md
+++ b/docs/api/browser-window.md
@@ -18,6 +18,9 @@ win.show();
 You can also create a window without chrome by using
 [Frameless Window](frameless-window.md) API.
 
+Security strategy of web pages showed by `BrowserWindow` is a bit different from
+normal browsers, see [Web Security](web-security.md) for more.
+
 ## Class: BrowserWindow
 
 `BrowserWindow` is an
diff --git a/docs/api/web-security.md b/docs/api/web-security.md
new file mode 100644
index 000000000000..8143e5f8494e
--- /dev/null
+++ b/docs/api/web-security.md
@@ -0,0 +1,21 @@
+# Web Security
+
+Because atom-shell has added node integration to normal web pages, there are
+some security adjustments that made atom-shell both more safe and more
+convenient.
+
+## Overriding `X-Frame-Options` header
+
+May websites (including Google and Youtube) use the
+[X-Frame-Options](x-frame-options) header to disable access to their websites
+in `iframe`s. In atom-shell you can add a `disable-x-frame-options` string in
+the `iframe`'s name to disable this:
+
+```html
+<!-- Refused to display -->
+<iframe name="google" src="https://google.com"></iframe>
+<!-- Loads as expected -->
+<iframe name="google-disable-x-frame-options" src="https://google.com"></iframe>
+```
+
+[x-frame-options](https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options)
