How to prevent clickjacking (X-Frame-Options, frame-ancestors)
If other sites can embed your page in a frame, they can trick visitors into clicking things. One header stops it.
Step by step, with screenshots: X-Frame-Options, frame-ancestors and nosniff: stop clickjacking →
Check your own site
Runs this check and the other 192, free, in about 45 seconds.
Or run only this check with the free Mobile-friendly test + CSP generator or the free Security headers checker.
What it is
Clickjacking is an attack where another website loads your page inside an invisible frame and lays its own content on top, so a visitor who thinks they are clicking a harmless button actually clicks one on your page. It works against any page that lets other sites frame it.
The defence is one response header: Content-Security-Policy: frame-ancestors 'self' (or 'none'), or the older X-Frame-Options: SAMEORIGIN (or DENY), which browsers still honour. getReport flags pages that send neither, since anyone can frame them. Pages with logged-in actions, such as accounts, checkouts and admin areas, need it most, but it is safe to send on every page unless you deliberately let partners embed you.
What a passing site looks like
- Other sites cannot embed this page in a framewarning · −2 ptseffort S
Other sites can embed this page in a frame
Why it matters. A site that loads your page in an invisible frame can trick visitors into clicking your buttons (clickjacking), for example "confirm order" or "delete account".
- Add frame-ancestors 'self' to your Content-Security-Policy, or send X-Frame-Options: SAMEORIGIN.
- Use frame-ancestors 'none' (or X-Frame-Options DENY) if the page never needs to be embedded.
Questions people ask
What is an example of a clickjacking attack?
A page promises a prize and shows a "Claim now" button. Underneath, invisible, is your shop's account page in a frame, positioned so the click lands on "Delete account" or "Confirm order". Because the visitor is logged in to your site, the action goes through. Variants trick people into changing settings, liking pages or granting camera access.
How do I test for clickjacking?
Create a local HTML file containing an <iframe> whose src is your page, and open it in a browser. If your page appears inside the frame, it can be clickjacked; if the frame stays empty and the console shows a frame-ancestors or X-Frame-Options error, you are protected. getReport checks the headers for you on every run.
How do I prevent clickjacking?
Send Content-Security-Policy: frame-ancestors 'self' to allow framing only by your own site, or 'none' to forbid it entirely, and add X-Frame-Options: SAMEORIGIN for older browsers. Set them in the web server, CDN or your CMS security settings so they apply to every page. Scripts that try to break out of frames are unreliable and no longer recommended.
What does "missing anti-clickjacking header" mean?
It is a scanner finding that a response has neither an X-Frame-Options header nor a CSP frame-ancestors directive, so other sites can put the page in a frame. Adding either header resolves it. frame-ancestors is the modern choice, and browsers follow it over X-Frame-Options when both are present.