How to add the X-Frame-Options header in Nginx

Nginx configuration (nginx server block)

add_header X-Frame-Options "SAMEORIGIN" always;

Place it in the server or location block, then run nginx -t and reload. add_header in a location block replaces headers set at server level, so repeat them where needed. The always flag sends the header on error responses too.

Before you deploy

Use DENY if your pages are never framed. CSP frame-ancestors is the modern replacement, and sending both is fine for older browsers.

Verify it works

curl -sI https://your-site.com | grep -i x-frame-options

Or run a free Korrali Web scan to check this and every other security header at once.

Other headers in Nginx

• Strict-Transport-Security in Nginx
• Content-Security-Policy in Nginx
• X-Content-Type-Options in Nginx
• Referrer-Policy in Nginx
• Permissions-Policy in Nginx
• Cross-Origin-Opener-Policy in Nginx
• Cross-Origin-Resource-Policy in Nginx