webzod
account

Stop other sites from framing your pages on Apache

headers.clickjacking.missing · effort: minutes

Why it matters

Without frame-ancestors or X-Frame-Options any site can load your pages in an invisible frame and trick visitors into clicking buttons they cannot see. One header tells browsers which sites, if any, may frame them.

The fix

  1. Add the lines below to the virtual host or .htaccess (mod_headers) and reload. append adds frame-ancestors as an extra policy next to any CSP the application already sends.
apache 
Header always set X-Frame-Options "SAMEORIGIN"
Header always append Content-Security-Policy "frame-ancestors 'self'"

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.