What Does X-Frame-Options Do?

X-Frame-Options is a security header that controls whether other websites are allowed to embed your pages inside a frame or iframe. Its single job is to stop clickjacking, an attack where a malicious site loads your real page invisibly on top of its own and tricks your visitors into clicking things they never intended to. If you have ever seen X-Frame-Options flagged in a security report, this guide explains exactly what it does and how to set it correctly.

What does X-Frame-Options actually do?

When a browser is about to display your page inside a frame, it checks for the X-Frame-Options header first. If the header forbids framing, the browser refuses to render your page in that context and the attack fails before it starts. Because the decision happens inside the browser, the protection works for every visitor automatically, with no change to your page content. It is one of the simplest headers to deploy and one of the highest-value defences against user-interface redress attacks.

How clickjacking works

In a clickjacking attack, the attacker builds a page that loads your site in a transparent frame positioned over decoy buttons. The visitor thinks they are clicking something harmless, but their click actually lands on your framed page, perhaps confirming a payment, changing a setting or approving a request while they are logged in. Because the visitor really is interacting with your genuine site in their own session, ordinary server-side defences do not catch it. Refusing to be framed removes the attack surface completely, which is why X-Frame-Options remains a baseline recommendation.

The values X-Frame-Options accepts

• DENY stops every site, including your own, from framing the page. This is the strictest option.
• SAMEORIGIN allows framing only by pages on your own domain, which suits most sites that use frames internally.
• ALLOW-FROM was an older option to permit a single named origin, but it is deprecated and ignored by modern browsers, so you should not rely on it.

For most websites, SAMEORIGIN is the sensible default. Choose DENY only if your pages never need to be framed at all, even by yourself.

X-Frame-Options and Content Security Policy

The modern replacement for X-Frame-Options is the frame-ancestors directive inside a Content Security Policy, which is more flexible and can name multiple allowed origins. Where a browser supports both, frame-ancestors takes precedence. The practical advice is to set both: keep X-Frame-Options for older clients and add frame-ancestors for current ones. Our guide on what a Content Security Policy is explains how frame-ancestors fits into a wider policy.

How to set X-Frame-Options

Send the header from your server on every response. On Apache add a Header directive with the value SAMEORIGIN, on Nginx add an add_header line, and on WordPress you can send it through the send_headers action or a security-headers plugin. A single line applies the protection across the whole site. After deploying, make sure any legitimate internal frames still work, since DENY will block them too.

Does every website need X-Frame-Options?

Almost every site benefits from it, but the right value depends on how you use frames. A brochure site or blog that is never embedded anywhere can safely use DENY. A web application that embeds its own dashboards, or a service that offers official embeddable widgets, should use SAMEORIGIN and pair it with a precise frame-ancestors directive. The one choice that is always wrong is leaving the header off entirely, because that hands attackers a free clickjacking vector. When in doubt, start with SAMEORIGIN and tighten from there.

How to check the header

The only reliable way to confirm X-Frame-Options is present and set to a safe value is to inspect your live response headers. Run a security scan with EzyAudit AI and you will see whether the header is set, whether the value is safe, and whether a matching frame-ancestors directive backs it up. Each finding comes with a plain-English explanation and a recommended fix. You can review the full set of checks we run on every scan. For the header definition and current browser support, see the MDN reference for X-Frame-Options.

Setting X-Frame-Options is a two-minute change that shuts down a whole class of clickjacking attacks. Scan your website now to see whether yours is configured correctly.