Limit frame-ancestors to sites you trust on nginx

Why it matters

frame-ancestors with * or a bare scheme lets any website frame your pages, which is exactly what clickjacking needs. List only your own origin and the partners that really embed you.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Stage 1: add a report-only header with the narrowed frame-ancestors and a reporting endpoint (as in the generic snippet) next to the current one, run sudo nginx -t and reload.
2. Stage 2: replace the wildcard in the enforced Content-Security-Policy line and remove the report-only line.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Clickjacking protection check
• Stop other sites from framing your pages
• Fix the X-Frame-Options value