What is X-Frame-Options?
X-Frame-Options is an HTTP header that controls whether a page may be embedded in a frame or iframe. X-Frame-Options (or CSP frame-ancestors) prevents clickjacking attacks.
Why X-Frame-Options matters
Clickjacking places your page in an invisible iframe on an attacker's site and tricks the visitor into clicking a button they cannot see, such as 'confirm payment' or 'change email'. The defence is to tell browsers who may embed your pages. The X-Frame-Options header does that with DENY or SAMEORIGIN, and the modern replacement is the CSP frame-ancestors directive, which also allows a list of trusted origins.
Send one or both on every response that renders HTML, including error pages. If a partner genuinely needs to embed a page (a widget, a report), give that page its own policy with the partner's origin rather than disabling protection site-wide. Note that the header protects your visitors from your page being framed elsewhere; it does nothing about frames you embed.
Example
Both forms, for old and new browsers:
X-Frame-Options: DENY
Content-Security-Policy: frame-ancestors 'none'
# A report page a client portal may embed:
Content-Security-Policy: frame-ancestors 'self' https://portal.client.comWhen both are present, browsers that understand CSP use frame-ancestors.
Common mistakes
- •No header at all, which is the default on most stacks.
- •
ALLOW-FROM, which modern browsers ignore. - •Removing the protection site-wide because one page needed embedding.
How Webmatik checks it
Webmatik's Clickjacking protection check passes when the audited pages send X-Frame-Options or a CSP frame-ancestors directive.
Check your own site
Free Website Security Checker
HTTPS, HSTS, CSP and the other headers most sites are missing — with exactly what to add.
Related Security terms
See how your website scores across SEO, GEO, performance, and more
Run a free audit