X-Frame-Options Header Guide: Stop Clickjacking
X-Frame-Options tells browsers whether your pages may be embedded in frames. Learn DENY vs SAMEORIGIN, how it relates to CSP frame-ancestors, and how to verify the header.
The X-Frame-Options response header controls whether a browser may display your page inside a <frame>, <iframe>, or similar embed. Without it (or a CSP frame-ancestors directive), another site can load your UI invisibly and trick users into clicking actions they never intended. That attack is called clickjacking.
For the attack model, see What is clickjacking?. This page is the header-focused guide: values, modern replacements, and how to confirm the header on a live security scan.
Allowed values
- `DENY` - never allow framing, even by pages on the same origin.
- `SAMEORIGIN` - allow framing only by pages from the same scheme, host, and port.
- `ALLOW-FROM` - obsolete and ignored by modern browsers; do not rely on it.
X-Frame-Options: DENY X-Frame-Options: SAMEORIGIN
Prefer CSP frame-ancestors for new work
Content-Security-Policy frame-ancestors is the modern control. It supports an explicit allow-list of parent origins and overrides X-Frame-Options when both are present in supporting browsers. Many teams still send X-Frame-Options for older clients while setting frame-ancestors as the source of truth.
Content-Security-Policy: frame-ancestors 'none' Content-Security-Policy: frame-ancestors 'self' Content-Security-Policy: frame-ancestors 'self' https://partner.example
If you intentionally iframe your own admin UI or a partner console, DENY will break that flow. Choose SAMEORIGIN or list the parent origins in frame-ancestors.
When each choice makes sense
- Marketing sites and dashboards - usually
DENYorframe-ancestors 'none'. - Legacy apps that self-embed -
SAMEORIGINwhile you migrate. - Trusted partner embeds - CSP allow-list only; never open framing to the whole web.
How to verify
- 1Fetch a representative HTML document (not only an API JSON route).
- 2Confirm
X-Frame-Optionsand/or CSPframe-ancestorsin the response. - 3Try loading the URL in a cross-origin test iframe; the browser should block it when DENY/none is set.
- 4Re-check after CDN or reverse-proxy changes that might strip headers.
PatchPings grades framing controls with other HTTP security headers. Use features or a free scan after you deploy, then keep the policy in version control so the next release cannot silently drop it. For deeper CSP work, continue with the Content-Security-Policy setup guide.
