X-Frame-Options Header

Controls whether your pages can be loaded inside an `<iframe>` on another site, which is the mechanism behind clickjacking.

Last updated August 9, 2026.

Severity when missing: Medium — see the missing-header finding on the security headers checker.

Check if your site sends this header

What it does

X-Frame-Options tells the browser whether the current page is allowed to be rendered inside a frame. `DENY` blocks framing entirely; `SAMEORIGIN` allows framing only by pages on the same origin. If neither applies, the browser refuses to render the page in the frame.

Why it matters

Without it, an attacker can embed your login page, payment form, or admin panel inside an invisible or disguised iframe on a malicious site and trick users into clicking buttons that actually act on your page — a clickjacking attack. This is especially relevant for any page with a state-changing action (login, delete, confirm, pay) that only requires a click.

Example header

Example only — this is not evidence from a live scan.

X-Frame-Options: SAMEORIGIN

How to test for it

Run `curl -sI https://example.com` and check for `X-Frame-Options` in the response.
Try embedding the page in a test `<iframe src="https://example.com"></iframe>` on a different origin — a browser honoring the header will refuse to render it and log a console error.
If the site legitimately needs to be embedded by specific partners, use the modern replacement — `Content-Security-Policy: frame-ancestors` — which supports an allow-list instead of an all-or-nothing rule.

How to add it

Nginx

add_header X-Frame-Options "SAMEORIGIN" always;

Apache

Header always set X-Frame-Options "SAMEORIGIN"

Cloudflare

Rules → Transform Rules → Modify Response Header → set `X-Frame-Options` to `SAMEORIGIN` or `DENY`.

Verify the fix

After deploying the change, re-run a Nivaronix scan on your domain, or check with curl -sI https://your-domain.example, to confirm the header now appears in the response.

Back to all security header guides Website security scanner

FAQ

What does X-Frame-Options do?

It tells the browser whether your page is allowed to be loaded inside an <iframe> on another site. This is the primary defense against clickjacking — an attacker framing your page invisibly over their own, so a user's click lands on your page instead of the one they see.

What's the difference between DENY and SAMEORIGIN?

DENY blocks framing entirely, even by your own site. SAMEORIGIN allows framing only by pages on the exact same origin — useful if you frame your own content but still want to block every other site.

Is X-Frame-Options deprecated?

Not deprecated, but it has a modern replacement for anything beyond an all-or-nothing rule: Content-Security-Policy's frame-ancestors directive, which supports an allow-list of specific origins. X-Frame-Options only supports DENY or SAMEORIGIN — if you need to allow one specific partner site to frame you, frame-ancestors is what actually supports that.

Does X-Frame-Options protect against XSS?

No — it only controls framing/clickjacking. It has no effect on cross-site scripting; that's what Content-Security-Policy's script-src and related directives are for.

Standards reference

MDN — X-Frame-Options. For exactly how Nivaronix evaluates this header during a scan, see the methodology page.