X-Frame-Options

X-Frame-Options is an HTTP response header that controls whether other sites may embed your page in a <frame>, <iframe> or <object>. It is a long-standing defence against clickjacking.

Why it matters

If an attacker can load your page invisibly inside theirs, they can trick users into clicking real buttons on it. Declaring that framing is not allowed, or allowed only from your own site, stops the browser from rendering the page in that context. The modern replacement is the frame-ancestors directive in Content Security Policy, which is more flexible and takes precedence in browsers that support both.

Example

X-Frame-Options: DENY
X-Frame-Options: SAMEORIGIN

DENY blocks all framing. SAMEORIGIN permits only pages from the same origin. An older ALLOW-FROM value is not supported by modern browsers.

Common mistakes

• Using DENY on a page that your own site embeds, breaking the feature.
• Relying on ALLOW-FROM to whitelist a partner.
• Setting the header in a <meta> tag, where it has no effect.
• Sending conflicting values from both application and proxy.

Related

• Clickjacking
• Content Security Policy
• Security headers
• iframe
• टूल: Security headers checker

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.