X-Frame-Options
X-Frame-Options controls whether your page may be embedded in an <iframe>. Blocking framing prevents clickjacking, where an attacker overlays your site invisibly to trick users into clicking. The modern replacement is the CSP frame-ancestors directive, but sending both maximises coverage.
Why it matters
Prevents the page from being embedded in iframes, protecting against clickjacking attacks.
How to add X-Frame-Options
add_header X-Frame-Options "DENY" always;Recommended value
DENY (or SAMEORIGIN if you frame your own pages)Avoid
ALLOW-FROM https://example.com (obsolete, ignored by modern browsers)Frequently asked questions
DENY or SAMEORIGIN — which should I use?
Use DENY unless your own application embeds its pages in frames, in which case use SAMEORIGIN. Avoid the obsolete ALLOW-FROM; use CSP frame-ancestors to allow specific origins instead.
Do I still need X-Frame-Options if I have CSP frame-ancestors?
frame-ancestors supersedes X-Frame-Options in browsers that support it. Sending both is a safe belt-and-braces approach for older clients; if you must pick one, prefer frame-ancestors.
Related reading
Other header guides
What the HSTS header does, how to configure max-age, includeSubDomains and preload, and how to add it in Nginx, Apache, and Cloudflare.
Why the X-Content-Type-Options: nosniff header matters, what MIME sniffing is, and how to set it in Nginx, Apache, and Cloudflare.
The X-XSS-Protection header is a legacy filter that can introduce vulnerabilities. Learn why modern guidance is to set it to 0 and rely on CSP.
How Referrer-Policy limits the referrer data sent to other sites, the safest values, and how to configure it in Nginx, Apache, and Cloudflare.
Is X-Frame-Options set on your site?
Scan any URL free to check X-Frame-Options and every other security header.
Scan Now - Free