Skip to content

X-Frame-Options Header

Controls whether your pages can be loaded inside an `<iframe>` on another site, which is the mechanism behind clickjacking.

Last updated August 9, 2026.

Severity when missing: Medium — see the missing-header finding on the security headers checker.

Check if your site sends this header

What it does

X-Frame-Options tells the browser whether the current page is allowed to be rendered inside a frame. `DENY` blocks framing entirely; `SAMEORIGIN` allows framing only by pages on the same origin. If neither applies, the browser refuses to render the page in the frame.

Why it matters

Without it, an attacker can embed your login page, payment form, or admin panel inside an invisible or disguised iframe on a malicious site and trick users into clicking buttons that actually act on your page — a clickjacking attack. This is especially relevant for any page with a state-changing action (login, delete, confirm, pay) that only requires a click.

Example header

Example only — this is not evidence from a live scan.

X-Frame-Options: SAMEORIGIN

How to test for it

  • Run `curl -sI https://example.com` and check for `X-Frame-Options` in the response.
  • Try embedding the page in a test `<iframe src="https://example.com"></iframe>` on a different origin — a browser honoring the header will refuse to render it and log a console error.
  • If the site legitimately needs to be embedded by specific partners, use the modern replacement — `Content-Security-Policy: frame-ancestors` — which supports an allow-list instead of an all-or-nothing rule.

How to add it

Nginx

add_header X-Frame-Options "SAMEORIGIN" always;

Apache

Header always set X-Frame-Options "SAMEORIGIN"

Cloudflare

Rules → Transform Rules → Modify Response Header → set `X-Frame-Options` to `SAMEORIGIN` or `DENY`.

Verify the fix

After deploying the change, re-run a Nivaronix scan on your domain, or check with curl -sI https://your-domain.example, to confirm the header now appears in the response.

Back to all security header guidesWebsite security scanner

Standards reference

MDN — X-Frame-Options. For exactly how Nivaronix evaluates this header during a scan, see the methodology page.