Security · Response header

X-Frame-Options

Prevents clickjacking by controlling framing.

What is X-Frame-Options?

X-Frame-Options tells the browser whether a page may be embedded in a <frame>, <iframe>, <embed>, or <object>. Modern replacement: CSP's `frame-ancestors` directive.

Typical usage

Set to DENY or SAMEORIGIN on pages that should not be framed by other sites.

Examples

X-Frame-Options: DENY

X-Frame-Options: SAMEORIGIN

Specification

RFC 7034

Frequently asked questions

What is the X-Frame-Options HTTP header?

X-Frame-Options tells the browser whether a page may be embedded in a <frame>, <iframe>, <embed>, or <object>. Modern replacement: CSP's `frame-ancestors` directive.

Is X-Frame-Options a request or response header?

X-Frame-Options is a response header — the server sends it to the client. Set to DENY or SAMEORIGIN on pages that should not be framed by other sites.

What does a X-Frame-Options header look like?

A typical X-Frame-Options header looks like: X-Frame-Options: DENY.

Related headers

Content-Security-Policy

The primary defense against XSS: whitelist trusted sources.

Strict-Transport-Security

Force browsers to use HTTPS for a domain (HSTS).

X-Content-Type-Options

Disables MIME-type sniffing.

Referrer-Policy

Controls the Referer header sent on outgoing links and requests.

Permissions-Policy

Controls which browser features and APIs pages can use.

Work with this header

cURL Converter →Turn a curl command into fetch / code and back.URL Parser →Break a URL into scheme, host, path and query.