Guides · HolicSecurity

What is X-Frame-Options?

Published 2 November 2026

The attack it prevents

In a clickjacking attack, a malicious page loads your site in an invisible iframe and places it over buttons of its own. The visitor thinks they're clicking "Play" or "Claim prize", but the click lands on your page: changing an account setting, confirming a payment, or granting a permission while they're logged in. Because the request comes from the visitor's own browser with their cookies, your server sees a normal action.

The values

• X-Frame-Options: DENY: no site may frame the page, including your own. The safest choice if you never use frames.
• X-Frame-Options: SAMEORIGIN: only pages from the same origin may frame it. Use this if your own site embeds its pages, for example in a preview pane.
• ALLOW-FROM uri: obsolete. Modern browsers ignore it, which leaves the page unprotected. Use CSP frame-ancestors instead.

frame-ancestors: the modern replacement

Content Security Policy's frame-ancestors directive does the same job with more control, for example frame-ancestors 'self' https://partner.example. When both headers are present, modern browsers follow frame-ancestors. Sending both is harmless and covers old browsers. Note that frame-ancestors only works as a header, not in a CSP meta tag. Our CSP generator includes it by default.

Adding it

# Nginx
add_header X-Frame-Options "DENY" always;
# Apache
Header always set X-Frame-Options "DENY"
# Cloudflare Pages / Netlify (_headers)
/*
  X-Frame-Options: DENY

If a partner legitimately embeds your widget, set the header per path instead of site-wide, and allow only that partner with frame-ancestors.

Is yours set?

Run the free security headers check. It reports X-Frame-Options and frame-ancestors along with HSTS, CSP and the rest, and gives a copy-paste fix for your host.

Frequently asked questions