Glossary
SECURITY HEADERS

X-Frame-Options

An HTTP response header that controls whether a page can be embedded in an <iframe>. Primary defence against clickjacking. Superseded by CSP frame-ancestors.

X-Frame-Options is an HTTP response header that tells browsers whether the page may be rendered inside a <frame>, <iframe>, <embed>, or <object>. It’s the classic clickjacking defence, though modern CSP frame-ancestors supersedes it.

Header Format

X-Frame-Options: DENY
X-Frame-Options: SAMEORIGIN

Values

  • DENY — cannot be framed by anyone (recommended for high-security pages)
  • SAMEORIGIN — can only be framed by pages on the same origin
  • ALLOW-FROM https://example.com — legacy, deprecated, no modern browser support

Modern Replacement

Content-Security-Policy: frame-ancestors 'none'; does the same job with more flexibility (multiple allowed origins, wildcards). Publish both headers for defence in depth — some older browsers only honour X-Frame-Options.

Common Miss

Setting SAMEORIGIN while running the same site on multiple domains. Result: frames break silently for legitimate use cases. Prefer explicit frame-ancestors in that case.

Check your X-Frame-Options and CSP together with the security headers audit.

Check the CSP glossary entry, read the HTTP security headers explainer, and see what a phishing link is — clickjacking is often the delivery mechanism.

← All terms Learning hub →