Skip to content
FixSecurityHeadersScan a site

How to add X-Frame-Options on Netlify

Last updated · Reviewed by a CISSP-certified security practitioner

To add X-Frame-Options on Netlify, set the header in _headers (in publish directory) with the value DENY. Prevents your site being embedded in iframes (clickjacking). Redeploy; check Deploy summary → Headers rules processed. Then confirm it with curl -I or a free FixSecurityHeaders scan.

What does X-Frame-Options do?

X-Frame-Options (or the modern CSP frame-ancestors) tells browsers whether other sites may put your pages inside an iframe.

Risk if missing: Attackers can overlay your page invisibly and trick users into clicking buttons (clickjacking) — e.g. changing settings or confirming payments.

What is the Netlify configuration?

Add this to _headers (in publish directory):

_headers (in publish directory)
/*
  X-Frame-Options: DENY

How do I add it step by step?

  1. Open _headers (in publish directory).
  2. Paste the X-Frame-Options configuration shown below.
  3. Redeploy; check Deploy summary → Headers rules processed.
  4. Run curl -I https://yourdomain.com and look for the x-frame-options line.
  5. Scan your site on FixSecurityHeaders to confirm the grade improved.

How do I verify it worked?

terminal
curl -sI https://yourdomain.com | grep -i "x-frame-options"
# expected:
# x-frame-options: DENY

Check your site now

Free scan, instant grade, exact fixes for your stack.

What are the common mistakes?

  • Use SAMEORIGIN if your own site frames its pages.
  • ALLOW-FROM is obsolete; use CSP frame-ancestors for allow-lists.
  • If CSP frame-ancestors is present, modern browsers ignore X-Frame-Options.
  • The _headers file must end up in your publish directory (e.g. public/).
  • Indent header lines under the path pattern.

Quick reference

HeaderX-Frame-Options
Recommended valueDENY
StackNetlify
Where_headers (in publish directory)
ComplianceOWASP ASVS V14.4.7, NIST 800-171 3.13.1, CMMC SC.L2-3.13.1

FAQ

What value should I use for X-Frame-Options?

A safe default is DENY. Use SAMEORIGIN if your own site frames its pages.

Why isn't X-Frame-Options showing up on Netlify?

The _headers file must end up in your publish directory (e.g. public/). Also clear any CDN or page cache, and check you edited the config that actually serves your domain.

Does X-Frame-Options affect SEO or performance?

No measurable performance cost — it's a few bytes per response. It doesn't affect rankings directly, but a misconfigured policy can break page resources, so test before enforcing.

Which compliance frameworks reference X-Frame-Options?

OWASP ASVS V14.4.7, NIST 800-171 3.13.1, CMMC SC.L2-3.13.1.

Related guides