Limit frame-ancestors to sites you trust on Apache

Why it matters

frame-ancestors with * or a bare scheme lets any website frame your pages, which is exactly what clickjacking needs. List only your own origin and the partners that really embed you.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Stage 1: add a Header always set Content-Security-Policy-Report-Only line with the narrowed frame-ancestors and a reporting endpoint (as in the generic snippet) and reload.
2. Stage 2: replace the wildcard in the enforced Content-Security-Policy and remove the report-only line.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Clickjacking protection check
• Stop other sites from framing your pages
• Fix the X-Frame-Options value