Glossary · Security

X-Frame-Options

X-Frame-Options is a response header that tells browsers whether a page may be displayed inside a frame or iframe, used to prevent clickjacking.

Updated October 6, 2026

X-Frame-Options is an HTTP response header that controls whether other sites may embed your page in a <frame>, <iframe> or <object>. It is a long-standing defence against clickjacking.

Why it matters

If an attacker can load your page invisibly inside theirs, they can trick users into clicking real buttons on it. Declaring that framing is not allowed, or allowed only from your own site, stops the browser from rendering the page in that context. The modern replacement is the frame-ancestors directive in Content Security Policy, which is more flexible and takes precedence in browsers that support both.

Example

X-Frame-Options: DENY
X-Frame-Options: SAMEORIGIN

DENY blocks all framing. SAMEORIGIN permits only pages from the same origin. An older ALLOW-FROM value is not supported by modern browsers.

Common mistakes

  • Using DENY on a page that your own site embeds, breaking the feature.
  • Relying on ALLOW-FROM to whitelist a partner.
  • Setting the header in a <meta> tag, where it has no effect.
  • Sending conflicting values from both application and proxy.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · SecurityCookie Prefixes (__Host- and __Secure-)Cookie prefixes are name prefixes that make browsers enforce extra rules, such as Secure and no Domain attribute, on that cookie.Glossary · SecurityCORS (Cross-Origin Resource Sharing)CORS is a browser mechanism that uses HTTP headers to let a server permit specific other origins to read its responses, relaxing the same-origin policy.Glossary · SecurityCORS Preflight RequestA CORS preflight is an automatic OPTIONS request a browser sends to check whether a cross-origin request is allowed before sending it.Guide · SSL & SecurityContent Security Policy (CSP) Guide: Directives, Nonces, RolloutBuild a Content Security Policy that works: key directives, nonces and strict-dynamic, Report-Only rollout, violation reports, and fixes for common breakage.7 min readGuide · SSL & SecurityCookie Flags Explained: Secure, HttpOnly and SameSiteWhat the Secure, HttpOnly, SameSite, Domain, Path and cookie prefix attributes do, how to set them in common stacks, and how to debug cookies that go missing.7 min readGuide · Web BasicsHow to Read HTTP Headers for Beginners (What Each Line Tells You)Learn to view and read HTTP response headers with a free tool or curl, and what status, server, cache, redirect and security headers mean for your website.7 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.