X-Frame-Options header
X-Frame-Options controls whether other sites can show your pages inside a frame or iframe.
Recommended value
X-Frame-Options: SAMEORIGINWhat it protects against
Clickjacking, where an attacker overlays your page invisibly to trick users into clicking.
Before you turn it on
Use DENY if your pages are never framed. CSP frame-ancestors is the modern replacement, and sending both is fine for older browsers.
How to add X-Frame-Options
Check your site's headers now
Korrali Web scans your site and shows which security headers are missing or misconfigured.
Run a free scan