webzod
account

Stop other sites from framing your pages on nginx

headers.clickjacking.missing · effort: minutes

Why it matters

Without frame-ancestors or X-Frame-Options any site can load your pages in an invisible frame and trick visitors into clicking buttons they cannot see. One header tells browsers which sites, if any, may frame them.

The fix

  1. Add the lines below to a shared snippet and include it in every server block, and in every location block that has add_header lines of its own (those replace inherited ones; nginx 1.29.3 and later can use add_header_inherit merge; instead).
  2. If the application also sends X-Frame-Options, hide its copy (proxy_hide_header X-Frame-Options; or fastcgi_hide_header X-Frame-Options;) so the header is not doubled. Run sudo nginx -t and reload.
/etc/nginx/snippets/security-headers.conf 
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Content-Security-Policy "frame-ancestors 'self'" always;

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.