How to stop other sites embedding yours
Without protection, a hostile page can load yours invisibly in a frame and trick visitors into clicking.
Why it matters
Clickjacking hides your real page under a fake one, so a visitor who thinks they are clicking "play" is actually clicking "delete account" or "pay" on your site. One header blocks it.
Steps
- Add the X-Frame-Options header with the value SAMEORIGIN.
- Or, better, add frame-ancestors 'self' to your Content-Security-Policy.
- Reload your site to confirm nothing you intentionally embed has broken.
For your developer
X-Frame-Options: SAMEORIGIN
Check it worked
Check the response headers for x-frame-options or a frame-ancestors rule in content-security-policy, then rescan.
Not sure if this affects your site?
Run a free scan to see exactly which of these your website needs.