# How to prevent clickjacking (X-Frame-Options, frame-ancestors)

> If other sites can embed your page in a frame, they can trick visitors into clicking things. One header stops it.

Security · HTML version: https://getreport.app/learn/clickjacking

## Frame embedding protection

Passing looks like: Other sites cannot embed this page in a frame.

**Why it matters.** A site that loads your page in an invisible frame can trick visitors into clicking your buttons (clickjacking), for example "confirm order" or "delete account".

**How to fix it.**

1. Add frame-ancestors 'self' to your Content-Security-Policy, or send X-Frame-Options: SAMEORIGIN.
2. Use frame-ancestors 'none' (or X-Frame-Options DENY) if the page never needs to be embedded.

Check your own page: https://getreport.app/