Glossary / X-Frame-Options

X-Frame-Options

X-Frame-Options is an HTTP header that tells the browser whether your page may be shown inside an <iframe> on another site. It protects against clickjacking, where an attacker embeds your site in a transparent frame and tricks the user into clicking invisible buttons.

The header has two working values. DENY forbids showing the page in a frame anywhere. SAMEORIGIN allows framing only on pages from the same domain, which is handy when you embed your own pages.

Without this protection an attacker can load your site in an invisible iframe on top of a bait page. The user thinks they are clicking 'Claim your prize' but is really clicking a button on your site, confirming a payment or changing a setting.

X-Frame-Options is an old and simple mechanism that every browser still supports. Modern projects often back it with the frame-ancestors directive in Content-Security-Policy, which is more flexible and lets you list specific allowed domains.

Example

X-Frame-Options: SAMEORIGIN

Common mistakes

• Using the obsolete ALLOW-FROM value. Most browsers ignore it; use CSP's frame-ancestors for a domain list.
• Setting DENY and then wondering why your own widget or page preview stopped loading in a frame - that case needs SAMEORIGIN.
• Thinking the header protects against XSS. It only stops clickjacking, that is framing.
• Putting it in an HTML <meta> tag. X-Frame-Options only works as an HTTP response header, not in meta.

Related terms

• HSTS (Strict-Transport-Security) HSTS (Strict-Transport-Security)
• Content-Security-Policy (CSP) Content-Security-Policy (CSP)
• X-Content-Type-Options X-Content-Type-Options
• Referrer-Policy Referrer-Policy
• Permissions-Policy Permissions-Policy