Stop other sites from framing your pages

Why it matters

Without frame-ancestors or X-Frame-Options any site can load your pages in an invisible frame and trick visitors into clicking buttons they cannot see. One header tells browsers which sites, if any, may frame them.

The fix

1. Send both headers below. frame-ancestors is the current standard; X-Frame-Options covers old browsers. If you already send a Content-Security-Policy, add frame-ancestors 'self' to it instead of sending a second CSP header.
2. If partner sites must embed your pages, list them in frame-ancestors (for example frame-ancestors 'self' https://partner.example) and leave X-Frame-Options out, because it cannot name other sites.

Content-Security-Policy: frame-ancestors 'self'
X-Frame-Options: SAMEORIGIN

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Clickjacking protection check
• Fix the X-Frame-Options value
• Limit frame-ancestors to sites you trust