X-Frame-Options / frame-ancestors

What clickjacking attacks are, how invisible iframes hijack your users' clicks, and the X-Frame-Options and frame-ancestors headers that stop them.

What it is

X-Frame-Options (or CSP frame-ancestors) controls whether your pages can be embedded in iframes on other sites. Without it, attackers can overlay invisible frames to hijack clicks — 'clickjacking'.

Why it matters

Clickjacking turns your trusted UI into an attacker's puppet: users think they're clicking your buttons but act on the attacker's page. One header eliminates the entire class.

How to fix it

nginx

add_header X-Frame-Options "SAMEORIGIN" always;

Apache

Header always set X-Frame-Options "SAMEORIGIN"

Modern (CSP)

Content-Security-Policy: frame-ancestors 'self';

See if your site passes

Check your framing headers free

FAQ

X-Frame-Options or frame-ancestors?

Use frame-ancestors in CSP for modern browsers; keep X-Frame-Options as fallback for older ones.

More explainers: HSTS (HTTP Strict Transport Security) · Content-Security-Policy (CSP) · DMARC (Domain-based Message Authentication) · Cookie Consent (GDPR/ePrivacy) · SPF (Sender Policy Framework) · DKIM (DomainKeys Identified Mail) · llms.txt (AI Crawler Guidance) · all checks