How to add the X-Frame-Options header in Netlify

X-Frame-Options controls whether other sites can show your pages inside a frame or iframe.

Netlify configuration (_headers file)

/*
  X-Frame-Options: SAMEORIGIN

Put the _headers file in your publish directory, or use a [[headers]] block in netlify.toml, then redeploy.

Use DENY if your pages are never framed. CSP frame-ancestors is the modern replacement, and sending both is fine for older browsers.

curl -sI https://your-site.com | grep -i x-frame-options

Or run a free Korrali Web scan to check this and every other security header at once.