How X-Frame-Options works
Clickjacking hides your page in an invisible frame and tricks users into clicking it. DENY blocks all framing; SAMEORIGIN allows only your own pages. The CSP directive frame-ancestors does the same with more control (a list of allowed sites) and wins when both are present; keep X-Frame-Options for older browsers.
Directives
| Value | Meaning |
|---|---|
DENY
|
Never show this page in a frame. |
SAMEORIGIN
|
Only pages from the same origin may frame it. |
ALLOW-FROM <uri>
|
Obsolete; ignored by current browsers. Use CSP frame-ancestors. |
Examples
X-Frame-Options: DENY
Content-Security-Policy: frame-ancestors 'none'Check it
curl -sI https://example.com | grep -i '^x-frame-options:'Paste a full set of response headers into the HTTP header checker to get every header explained and common mistakes flagged.
Related headers
- Content-Security-Policy: restricts where a page may load scripts, styles, images and other resources from, to contain XSS.
- Cross-Origin-Opener-Policy: separates your page from cross-origin windows it opens or is opened by (COOP).
- X-Content-Type-Options: stops browsers from guessing (“sniffing”) a response’s type instead of trusting Content-Type.
More security headers
Strict-Transport-Security , Referrer-Policy , Permissions-Policy , Cross-Origin-Embedder-Policy , Cross-Origin-Resource-Policy .
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What does the X-Frame-Options header do?
The X-Frame-Options response header controls whether the page may be shown in a frame on another site, to prevent clickjacking. Clickjacking hides your page in an invisible frame and tricks users into clicking it. DENY blocks all framing; SAMEORIGIN allows only your own pages. The CSP directive frame-ancestors does the same with more control (a list of allowed sites) and wins when both are present; keep X-Frame-Options for older browsers.
How do I see the X-Frame-Options header?
Run "curl -sI https://example.com" to print a response’s headers, or open the Network tab in your browser’s dev tools and select the request. Paste the headers into the HTTP header checker on this site to get each one explained.