KKorrali Web

Security headers › X-Frame-Options

How to add the X-Frame-Options header in Vercel

X-Frame-Options controls whether other sites can show your pages inside a frame or iframe.

Vercel configuration (vercel.json)

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        {
          "key": "X-Frame-Options",
          "value": "SAMEORIGIN"
        }
      ]
    }
  ]
}

Add to vercel.json at the project root and redeploy. Next.js projects on Vercel can set headers in next.config instead.

Before you deploy

Use DENY if your pages are never framed. CSP frame-ancestors is the modern replacement, and sending both is fine for older browsers.

Verify it works

curl -sI https://your-site.com | grep -i x-frame-options

Or run a free Korrali Web scan to check this and every other security header at once.

Scan your site free

Other headers in Vercel