Missing X-Frame-Options Header

What this finding means

Your site does not send an X-Frame-Options header (and has no equivalent Content-Security-Policy frame-ancestors directive). Browsers will allow any other site to load your pages inside an iframe, which is the precondition for clickjacking attacks against anything on the page a user can click.

Why it matters

Without it, an attacker can embed your login page, payment form, or admin panel inside an invisible or disguised iframe on a malicious site and trick users into clicking buttons that actually act on your page — a clickjacking attack. This is especially relevant for any page with a state-changing action (login, delete, confirm, pay) that only requires a click.

What Nivaronix checks

Nivaronix's security headers checker inspects the response headers your site sends and reports whether X-Frame-Options is present. This is a security misconfiguration check based on the header's presence and configuration — not a vulnerability scan, exploit attempt, or penetration test.

Evidence example

Example only, for illustration — not evidence from a live scan of any specific site.

HTTP/1.1 200 OK
(no X-Frame-Options header present)

How to fix it

add_header X-Frame-Options "SAMEORIGIN" always;

Header always set X-Frame-Options "SAMEORIGIN"

Rules → Transform Rules → Modify Response Header → set `X-Frame-Options` to `SAMEORIGIN` or `DENY`.

Verify the fix

Re-run a scan on your domain, or check manually with curl -sI https://your-domain.example, and confirm X-Frame-Options now appears in the response with the expected value.

Standards reference

MDN — X-Frame-Options. See the methodology page for exactly how this finding is scored.