Fix the X-Frame-Options value on WordPress

headers.clickjacking.xfo_invalid · effort: minutes

Why it matters

Browsers only honour a single DENY or SAMEORIGIN. ALLOW-FROM or another unknown value is ignored and leaves the page frameable, while conflicting values block all framing, even by your own pages.

The fix

Check whether a security plugin, the theme and the server or CDN each add X-Frame-Options, and turn it off in all but one place.
Make the remaining value SAMEORIGIN (or DENY if nothing frames the site).

Read the documentation (opens in a new tab)

Reported by the Clickjacking protection check
Stop other sites from framing your pages
Limit frame-ancestors to sites you trust

Scan your domain to see whether this applies to you.

Why it matters

The fix

Related