How to add the X-Frame-Options header in Apache

X-Frame-Options controls whether other sites can show your pages inside a frame or iframe.

Apache configuration (.htaccess or virtual host)

<IfModule mod_headers.c>
  Header always set X-Frame-Options "SAMEORIGIN"
</IfModule>

Requires mod_headers (a2enmod headers on Debian/Ubuntu). Reload Apache after editing the virtual host.

Use DENY if your pages are never framed. CSP frame-ancestors is the modern replacement, and sending both is fine for older browsers.

curl -sI https://your-site.com | grep -i x-frame-options

Or run a free Korrali Web scan to check this and every other security header at once.