← Back to Security Tips

X-Frame-Options Explained: Protecting Against Clickjacking

X-Frame-Options is a security header that helps control whether your website can be displayed inside another website’s frame.

Simple idea: Frame protection helps stop attackers from hiding your website behind fake buttons or deceptive pages.

What Is Clickjacking?

Clickjacking is an attack where a malicious site tricks users into clicking something different from what they think they are clicking. This can happen when your website is invisibly loaded inside another page.

Advertisement

How X-Frame-Options Helps

The X-Frame-Options header tells the browser whether your website is allowed to be embedded in a frame. If framing is blocked, attackers have fewer opportunities to hide your site inside deceptive pages.

Common Values

  • DENY: Prevents the page from being displayed in a frame.
  • SAMEORIGIN: Allows the page to be framed only by the same website origin.

Example Header

X-Frame-Options: SAMEORIGIN

When Should You Use It?

Most public websites should use frame protection unless they intentionally need to be embedded by trusted third-party systems. Admin dashboards, login pages, payment pages, and account pages should be especially protected.

Scan for Missing Headers