Fix the X-Frame-Options value on Cloudflare

Why it matters

Browsers only honour a single DENY or SAMEORIGIN. ALLOW-FROM or another unknown value is ignored and leaves the page frameable, while conflicting values block all framing, even by your own pages.

The fix

1. Create or edit a Response Header Transform Rule (Rules, Overview) with Set static, header X-Frame-Options, value SAMEORIGIN. Set replaces whatever the origin sent, leaving one valid value.
2. For a partner that must frame you, use Add static with header Content-Security-Policy and value frame-ancestors 'self' https://partner.example instead, and remove X-Frame-Options with a Remove operation.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Clickjacking protection check
• Stop other sites from framing your pages
• Limit frame-ancestors to sites you trust