Skip to content
ImpactrStart an engagement

HTTP security header

X-Frame-Options

X-Frame-Options tells the browser whether a page may be rendered inside a frame or iframe. Setting it to DENY (or SAMEORIGIN) prevents other sites from embedding the page and tricking users into clicking hidden elements - a clickjacking attack. Modern policies increasingly use CSP frame-ancestors, but X-Frame-Options remains widely supported.

Example

X-Frame-Options: DENY

Configuration guidance

  • Use DENY unless the page must be framed by same-origin content (then SAMEORIGIN).
  • Prefer CSP frame-ancestors for granular, modern control; send both for coverage.

Helps mitigate

Related headers

MDN: X-Frame-Options

Impactr finds and proves whether flaws like this are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.

Start an engagement
← All security headers