Security Headers Checker / Headers
X-Frame-Options and frame-ancestors: stop clickjacking
A site that frames your page can lay invisible buttons over it and trick visitors into clicking yours (clickjacking). X-Frame-Options DENY or SAMEORIGIN stops other sites from framing the page; CSP frame-ancestors does the same with more control and takes precedence where both are sent.
What to send
X-Frame-Options: SAMEORIGIN
Use DENY when no page of yours is ever framed, SAMEORIGIN when your own pages frame each other. For a list of allowed sites, use Content-Security-Policy: frame-ancestors 'self' https://partner.example.
# server { } block (or a file included in every server block).
# "always" also sends the header on error and redirect responses.
add_header X-Frame-Options "SAMEORIGIN" always;Will this break anything?
- X-Frame-Options: DENY stops every site from framing yours, including your own other domains, booking or payment widgets that frame your pages, and page-builder previews. SAMEORIGIN allows your own origin.
How our grade counts it
- Coverage, up to 10 points: CSP frame-ancestors (header, not meta) or X-Frame-Options DENY / SAMEORIGIN; ALLOW-FROM counts as absent
Common mistakes
- ALLOW-FROM: no current browser supports it, so the page is unprotected.
- Two different X-Frame-Options values: browsers may ignore both.
- frame-ancestors in a <meta> CSP: ignored.
Check your site
The checker reads X-Frame-Options the way a browser applies it, alongside every other security header.
Open the Security Headers Checker