Skip to content
Skip to content
API Pricing RU Sign In
← All HTTP Headers
Security

X-Frame-Options

Controls whether a page can be displayed in a frame or iframe, protecting against clickjacking attacks.

Syntax

X-Frame-Options: DENY | SAMEORIGIN

Example

X-Frame-Options: SAMEORIGIN

Description

The X-Frame-Options header controls whether a browser can render a page in <frame>, <iframe>, <embed>, or <object>. Key defense against clickjacking.

Values: DENY (no framing), SAMEORIGIN (same-origin only), ALLOW-FROM uri (deprecated).

The modern replacement is frame-ancestors in Content-Security-Policy. For maximum compatibility, use both headers.

Check if your website sends this header correctly

Check your headers →

Related Articles

Web Server Security Hardening Checklist: Nginx and Apache
Complete web server hardening checklist for nginx and Apache. File permissions, security headers, TLS configuration, access control, and monitoring.
Reverse Proxy: How It Works and Why You Need One
Understand reverse proxies — how they work, their benefits for security, performance, and scalability, and how to configure Nginx as a reverse proxy.
Website SEO Audit: 20-Point Checklist
Practical SEO audit checklist: 20 points to check technical SEO, content, performance, and security.

Related Headers

Content-Security-Policy
Controls which resources the browser is allowed to load for a page, helping prevent XSS and data injection attacks.
Cross-Origin-Opener-Policy
Isolates the browsing context to prevent cross-origin attacks like Spectre from accessing sensitive data.
Cross-Origin-Resource-Policy
Restricts which origins can load a resource, preventing unauthorized cross-origin reads.
Permissions-Policy
Controls which browser features and APIs can be used on the page, such as camera, microphone, and geolocation.
Referrer-Policy
Controls how much referrer information is included with requests, balancing privacy with analytics needs.
Strict-Transport-Security
Instructs browsers to only access the site via HTTPS, protecting against protocol downgrade attacks and cookie hijacking.

Start monitoring for free

Sign up and get access to API, monitoring and notifications

Create Account API Documentation