Skip to content

How to prevent clickjacking (X-Frame-Options, frame-ancestors)

Security1 min readFixes check x-frame-options-or-frame-ancestors

If other sites can embed your page in a frame, they can trick visitors into clicking things. One header stops it.

Step by step, with screenshots: Content-Security-Policy: from report-only to enforced →

Check your own site

Runs this check and the other 186, free, in about 45 seconds.

What a passing site looks like

  • Other sites cannot embed this page in a framewarning · −2 ptseffort S

Other sites can embed this page in a frame

Why it matters. A site that loads your page in an invisible frame can trick visitors into clicking your buttons (clickjacking), for example "confirm order" or "delete account".

How to fix it.
  1. Add frame-ancestors 'self' to your Content-Security-Policy, or send X-Frame-Options: SAMEORIGIN.
  2. Use frame-ancestors 'none' (or X-Frame-Options DENY) if the page never needs to be embedded.

Filed under Security. Copy is generated from the same catalogue that scores every report, so what you read here is what the report says.