All questions
Q & A Security · September 11, 2026

What is the difference between X-Frame-Options and CSP frame-ancestors?

Both control whether the page can be embedded in an iframe. X-Frame-Options (2013) is simpler but limited to DENY, SAMEORIGIN, or (deprecated) ALLOW-FROM one origin. CSP frame-ancestors (2016) allows multiple origins, wildcards, and integrates with the rest of your CSP. Modern deployments ship both — CSP for browsers that support it, X-Frame-Options as a fallback.

Read the full guide
HTTP Security Headers Explained: HSTS, CSP, X-Frame-Options, and the Rest
HTTP security headers are the browser-enforced defence layer that runs before your application code. Deployed correctly, they eliminate whole classes of attacks — even when the underlying application has bugs. Deployed incorrectly, they silently break the site.
Related questions
Do I need HTTPS to use security headers? How do I test my security headers without breaking production? What does an open port mean for security? Which security headers should every site set? Will CSP break my site?