Stop other sites from framing your pages on Caddy

Why it matters

Without frame-ancestors or X-Frame-Options any site can load your pages in an invisible frame and trick visitors into clicking buttons they cannot see. One header tells browsers which sites, if any, may frame them.

The fix

1. Add the lines below to the site block and reload. The > prefix sets the header after the upstream answers, replacing a copy from the application; ? adds the CSP only when the application sends none, so if it does, add frame-ancestors 'self' to that policy.

header >X-Frame-Options SAMEORIGIN
header ?Content-Security-Policy "frame-ancestors 'self'"

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Clickjacking protection check
• Fix the X-Frame-Options value
• Limit frame-ancestors to sites you trust