← Back to Security Tips
X-Frame-Options Explained: Protecting Against Clickjacking
X-Frame-Options is a security header that helps control whether your website can be displayed inside another website’s frame.
Simple idea: Frame protection helps stop attackers from hiding your website behind fake buttons or deceptive pages.
What Is Clickjacking?
Clickjacking is an attack where a malicious site tricks users into clicking something
different from what they think they are clicking. This can happen when your website
is invisibly loaded inside another page.
How X-Frame-Options Helps
The X-Frame-Options header tells the browser whether your website is allowed to be
embedded in a frame. If framing is blocked, attackers have fewer opportunities to
hide your site inside deceptive pages.
Common Values
- DENY: Prevents the page from being displayed in a frame.
- SAMEORIGIN: Allows the page to be framed only by the same website origin.
Example Header
X-Frame-Options: SAMEORIGIN
When Should You Use It?
Most public websites should use frame protection unless they intentionally need to
be embedded by trusted third-party systems. Admin dashboards, login pages, payment
pages, and account pages should be especially protected.
X-Frame-Options vs Content-Security-Policy
Modern websites may also use Content-Security-Policy with the frame-ancestors
directive. This gives more flexible control, but X-Frame-Options is still commonly
checked and useful for many sites.
Final Thought
X-Frame-Options is simple, but it can prevent a serious class of browser-based attacks.
If your website scanner reports it as missing, it is worth reviewing.
Scan for Missing Headers