X-Frame-Options and clickjacking

Who may embed this site in a frame. It is what stops clickjacking; the CSP frame-ancestors directive does the same job and counts for this row.

• Help center

Clickjacking is an attack in which your site is loaded inside an invisible frame on another page, and the visitor is tricked into clicking buttons they cannot see: confirming a payment, changing settings, granting a permission. The defence is to tell the browser who may embed your pages in a frame.

How SiteScan grades it

Two headers do this job, and either one counts:

• X-Frame-Options: DENY (no framing at all) or SAMEORIGIN (only your own pages) is “Strong”;
• the CSP directive frame-ancestors, its modern replacement, is also “Strong” whatever its value;
• any other X-Frame-Options value, such as the obsolete ALLOW-FROM, is “Weak” — current browsers ignore it.

How to set it

For most sites X-Frame-Options: SAMEORIGIN is enough. If you already have a Content-Security-Policy, add frame-ancestors 'self' to it; to allow specific partners, list them: frame-ancestors 'self' https://partner.example. Sending both headers is fine — browsers that understand frame-ancestors give it priority. If your pages are meant to be embedded as widgets, use frame-ancestors with an explicit list instead of turning protection off.