Fix the X-Frame-Options value

Why it matters

Browsers only honour a single DENY or SAMEORIGIN. ALLOW-FROM or another unknown value is ignored and leaves the page frameable, while conflicting values block all framing, even by your own pages.

The fix

1. Send exactly one X-Frame-Options header with DENY or SAMEORIGIN. Conflicting values usually mean two layers (application and web server, or a plugin and the CDN) both set it; keep one.
2. If you used ALLOW-FROM for a partner, replace it with frame-ancestors 'self' https://partner.example in the Content-Security-Policy and drop X-Frame-Options.

X-Frame-Options: SAMEORIGIN

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Clickjacking protection check
• Stop other sites from framing your pages
• Limit frame-ancestors to sites you trust