webzod
account

Stop other sites from framing your pages on Cloudflare

headers.clickjacking.missing · effort: minutes

Why it matters

Without frame-ancestors or X-Frame-Options any site can load your pages in an invisible frame and trick visitors into clicking buttons they cannot see. One header tells browsers which sites, if any, may frame them.

The fix

  1. Open Rules, Overview, choose Create rule, Response Header Transform Rule, and add the two operations below for this host. The DNS record must be Proxied.
  2. Use Add static for the CSP so an existing policy from the origin is kept (browsers enforce both). The Add security headers Managed Transform (Rules, Settings, Managed Transforms) also sets X-Frame-Options SAMEORIGIN, together with a few other headers.
text 
Rule type:     Response Header Transform Rule
If:            Hostname equals example.com
Operation 1:   Set static   X-Frame-Options          SAMEORIGIN
Operation 2:   Add static   Content-Security-Policy  frame-ancestors 'self'

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.