KKorrali Web

Security headers › X-Frame-Options

How to add the X-Frame-Options header in Cloudflare

X-Frame-Options controls whether other sites can show your pages inside a frame or iframe.

Cloudflare configuration (Transform Rules)

Rules > Transform Rules > Modify Response Header
Action: Set static
Header name: X-Frame-Options
Value: SAMEORIGIN

Create the rule for your hostname in the Cloudflare dashboard. For HSTS, Cloudflare also has a dedicated setting under SSL/TLS > Edge Certificates. On Cloudflare Pages you can use a _headers file instead.

Before you deploy

Use DENY if your pages are never framed. CSP frame-ancestors is the modern replacement, and sending both is fine for older browsers.

Verify it works

curl -sI https://your-site.com | grep -i x-frame-options

Or run a free Korrali Web scan to check this and every other security header at once.

Scan your site free

Other headers in Cloudflare