Stop other sites from framing your pages on Netlify

Why it matters

Without frame-ancestors or X-Frame-Options any site can load your pages in an invisible frame and trick visitors into clicking buttons they cannot see. One header tells browsers which sites, if any, may frame them.

The fix

1. Add the lines below to _headers in the publish directory (or [[headers]] in netlify.toml) and redeploy. If you already set a Content-Security-Policy there, add frame-ancestors 'self' to it instead of a second line.
2. _headers rules do not apply to Netlify Functions, Edge Functions or proxied responses; those must send the headers themselves.

/*
  X-Frame-Options: SAMEORIGIN
  Content-Security-Policy: frame-ancestors 'self'

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Clickjacking protection check
• Fix the X-Frame-Options value
• Limit frame-ancestors to sites you trust