Skip to content
RU Sign In
RU
← All HTTP Headers
Security

X-Frame-Options

Controls whether a page can be displayed in a frame or iframe, protecting against clickjacking attacks.

Syntax

X-Frame-Options: DENY | SAMEORIGIN

Example

X-Frame-Options: SAMEORIGIN

Description

The X-Frame-Options header controls whether a browser can render a page in <frame>, <iframe>, <embed>, or <object>. Key defense against clickjacking.

Values: DENY (no framing), SAMEORIGIN (same-origin only), ALLOW-FROM uri (deprecated).

The modern replacement is frame-ancestors in Content-Security-Policy. For maximum compatibility, use both headers.

How real sites send this header

Home-page responses of 502 popular sites from the enterno.io /check catalogue, checked in the last 30 days.

52.4% (263 of 502) send X-Frame-Options.

Most common values:

  • SAMEORIGIN — 208 sites
  • DENY — 47 sites
  • allow-from https://www.freshworks.com — 2 sites

See it on: google.com, discord.com, github.com, cloudflare.com, habr.com

Check if your website sends this header correctly

Check your headers →

Related Articles

Build a Website with AI: 9-Point Pre-Launch Checklist
How to build a website with AI, then check it before launch: HTTPS, security headers, image weight, soft 404s, leftover noindex, forms and leaked API keys.
Nginx Config Guide: nginx.conf, Server Blocks, Locations
Nginx configuration: where nginx.conf and sites-enabled live, the main, http, server and location contexts, a minimal server block, nginx -t, reload.
Website Security Check: The Complete Checklist
Website security check: the complete checklist. How to test any website online in 5 minutes — HTTPS, security headers, CSP, cookies, malware — plus a full owner's checklist with curl examples and a layer-by-layer summary table.

Related Headers

Content-Security-Policy
Controls which resources the browser is allowed to load for a page, helping prevent XSS and data injection attacks.
Cross-Origin-Opener-Policy
Isolates the browsing context to prevent cross-origin attacks like Spectre from accessing sensitive data.
Cross-Origin-Resource-Policy
Restricts which origins can load a resource, preventing unauthorized cross-origin reads.
Permissions-Policy
Controls which browser features and APIs can be used on the page, such as camera, microphone, and geolocation.
Referrer-Policy
Controls how much referrer information is included with requests, balancing privacy with analytics needs.
Strict-Transport-Security
Instructs browsers to only access the site via HTTPS, protecting against protocol downgrade attacks and cookie hijacking.

Related guides

Longer-form reading on this topic from the knowledge base.

Automate this check

Set up continuous monitoring and get an alert when something breaks. No manual runs to remember.

Start free

Related Articles

HTTP

How to Fix 404 Not Found Errors: Visitors, nginx, Apache, CDN

19 min · Read → HTTP

HTTP Methods Explained: GET, POST, PUT, DELETE and Beyond

6 min · Read → HTTP

Server-Sent Events vs WebSockets: Which to Use for Realtime

5 min · Read →
All articles →

Start monitoring for free

Sign up and get access to API, monitoring and notifications

Create Account API Documentation