X-Frame-Options

What it means

X-Frame-Options is an HTTP response header that tells the browser whether your page may be shown inside a frame, iframe, embed or object on another page. The two values in use are DENY, which blocks all framing, and SAMEORIGIN, which allows only your own site. It applies to the page that sends it, so each response you care about needs it.

It exists to stop [[clickjacking]]: an attacker loads your page invisibly inside theirs and tricks a visitor into clicking a real button. RFC 7034 describes it. An older ALLOW-FROM value is obsolete and modern browsers ignore it.

Why it matters

A page that can be framed can be driven by someone else. A signed-in visitor can be nudged into approving a payment, changing an email address or granting access, while believing they are clicking on the attacker's page. The action is genuine, so your logs show an ordinary request.

The header costs one line of server configuration. Security questionnaires and scanners ask for it, and its absence on a sensitive page is an easy finding to raise. It is not the whole answer today: the frame-ancestors directive of a content security policy is the modern control and takes priority where browsers support it.

How it shows up

You meet it in web server, proxy and framework settings, often added by a default security middleware. Check it on the pages that matter: sign-in, settings, payments and anything with a confirm button. Check API and error responses too, because a missing header on a login error page is common.

Typical mistakes are setting it only on the home page, setting it on one server behind a load balancer and not the others, using ALLOW-FROM and believing it works, and sending two different values so the browser ignores both. If you do need to be embedded by a partner, use frame-ancestors with that partner's origin.