How to add the X-Frame-Options header in Next.js

X-Frame-Options controls whether other sites can show your pages inside a frame or iframe.

Next.js configuration (next.config)

async headers() {
  return [
    {
      source: "/:path*",
      headers: [{ key: "X-Frame-Options", value: "SAMEORIGIN" }],
    },
  ];
}

Add the headers() function to your Next.js config and restart or redeploy. Headers set by a proxy or CDN in front can override these.

Use DENY if your pages are never framed. CSP frame-ancestors is the modern replacement, and sending both is fine for older browsers.

curl -sI https://your-site.com | grep -i x-frame-options

Or run a free Korrali Web scan to check this and every other security header at once.