Headers

X-Frame-Options and frame-ancestors: the anti-clickjacking header.

Published 2026-05-19 · Last updated 2026-05-19 · Vantyris editorial

What this means for your business

• An attacker copies a single button from your site (say, 'Confirm payment' or 'Delete account') and overlays it on a page they control. The visitor thinks they're clicking 'Play video' on the attacker's site. They're actually clicking the hidden button on yours.
• X-Frame-Options is the original anti-clickjacking header, and CSP's frame-ancestors directive is its modern successor. Send either (or both) and the browser refuses to render your site inside an iframe from a different origin.
• Unless your site is specifically designed to be embedded (e.g., a help widget, an embeddable map), you want this turned ON.

How to fix

Add either X-Frame-Options: DENY or Content-Security-Policy: frame-ancestors 'none' to your site's response headers. If you already use CSP, just add frame-ancestors to your existing policy.

1. Pick your header. If you have no CSP at all, the simplest option is X-Frame-Options: DENY. If you already have CSP, add frame-ancestors 'none' to the existing policy. Modern browsers prefer frame-ancestors. Old IE only reads X-Frame-Options, so some sites send both.
2. Add it to your host's response headers. Most hosts let you add custom headers in the SSL/security section. Cloudflare: Rules → Transform Rules → Modify Response Header. Apache: in .htaccess, Header always set X-Frame-Options DENY. Nginx: add_header X-Frame-Options DENY always;.
3. Test it. Open Chrome DevTools → Network, click any request to your domain and check Response Headers. You should see x-frame-options: DENY (or your frame-ancestors directive in the CSP). observatory.mozilla.org shows the same.

Owner: Your web host or developer. · Time: 5 minutes.

Common gotchas

• If your site IS supposed to be embedded somewhere specific (you provide a widget for partners), use X-Frame-Options: ALLOW-FROM https://partner.com (deprecated) or Content-Security-Policy: frame-ancestors https://partner.com (modern).
• X-Frame-Options: SAMEORIGIN lets your own domain embed itself. Useful if your site has internal iframes. Unnecessary otherwise.
• Some hosts (older shared hosting) don't let you add custom headers. In that case, a CDN in front (Cloudflare's free tier) gives you the control.

How to verify the fix

Run a Vantyris scan or check observatory.mozilla.org. Both flag the absence of either header.

Cyber Essentials alignment

This finding informs the following Cyber Essentials control areas (the UK government's baseline scheme, a sound checklist in any country):

• A2. Secure configuration: devices and services hardened against the weaknesses they ship with by default.

Vantyris is not a CE certifying body. The mapping above is informational.

Common follow-up questions

References

• MDN: X-Frame-Options MDN
• OWASP: clickjacking defense cheat sheet OWASP

Related explainers

• Content Security Policy: the header that stops most XSS attacks dead.
• HSTS: the security header that locks HTTPS on for good.