Security · Response header

X-Frame-Options

Prevents clickjacking by controlling framing.

What is X-Frame-Options?

X-Frame-Options tells the browser whether a page may be embedded in a <frame>, <iframe>, <embed>, or <object>. Modern replacement: CSP's `frame-ancestors` directive.

Typical usage

Set to DENY or SAMEORIGIN on pages that should not be framed by other sites.

Examples

X-Frame-Options: DENY

X-Frame-Options: SAMEORIGIN

Specification

RFC 7034

Related headers

Content-Security-Policy

The primary defense against XSS: whitelist trusted sources.

Strict-Transport-Security

Force browsers to use HTTPS for a domain (HSTS).

X-Content-Type-Options

Disables MIME-type sniffing.

Referrer-Policy

Controls the Referer header sent on outgoing links and requests.

Permissions-Policy

Controls which browser features and APIs pages can use.