HTTP Security Headers

X-Frame-Options

Stops other sites from embedding your pages in an invisible frame to trick users into clicking — the classic defense against clickjacking.

What it is

X-Frame-Options controls whether a browser may render a page inside a framing element. It exists to prevent clickjacking — an attack where a malicious site overlays your page in a transparent iframe and tricks the user into clicking something they can't see (e.g. a 'delete account' button).

Values

DENY
The page can never be framed, by anyone — including your own site.
SAMEORIGIN
The page may only be framed by pages from the same origin.
ALLOW-FROM uri
Obsolete and ignored by modern browsers. Use CSP frame-ancestors instead.
HTTP RESPONSE HEADER
X-Frame-Options: SAMEORIGIN

CSP frame-ancestors supersedes this

Modern replacement

The CSP directive frame-ancestors 'none' (equivalent to DENY) or frame-ancestors 'self' (equivalent to SAMEORIGIN) supersedes X-Frame-Options and can allow-list multiple specific origins — something X-Frame-Options cannot do. Send both for defense in depth and for older-browser coverage.

Why it matters

  • It is the simplest one-line defense against clickjacking on pages that perform sensitive, state-changing actions.
  • Login, payment and account-settings pages should never be framable by third parties — a single header closes that hole.
  • It is trivially cheap and widely supported, so its absence on a sensitive page is almost always an oversight.

Common mistakes

  • Relying on the obsolete ALLOW-FROM value, which modern browsers ignore — leaving the page unexpectedly framable.
  • Setting DENY on a page you actually need to embed in your own app, breaking legitimate iframes.
  • Using X-Frame-Options alone when you need to allow multiple partner origins — only CSP frame-ancestors can express that.

How WebInspect checks this

  • WebInspect reports whether X-Frame-Options is present and echoes its value (DENY / SAMEORIGIN).
  • It recognizes when CSP frame-ancestors is set and treats that as satisfying the anti-framing requirement.
  • It flags an obsolete ALLOW-FROM value as ineffective in modern browsers.