X-Frame-Options explained

Last updated November 11, 2026 · Reviewed by a CISSP-certified security practitioner

X-Frame-Options: X-Frame-Options (or the modern CSP frame-ancestors) tells browsers whether other sites may put your pages inside an iframe. Recommended value: DENY.

What risk does it prevent?

Attackers can overlay your page invisibly and trick users into clicking buttons (clickjacking) — e.g. changing settings or confirming payments.

What is the safe recommended value?

X-Frame-Options: DENY

What are the gotchas?

Use SAMEORIGIN if your own site frames its pages.
ALLOW-FROM is obsolete; use CSP frame-ancestors for allow-lists.
If CSP frame-ancestors is present, modern browsers ignore X-Frame-Options.

Which compliance controls reference it?

OWASP ASVS V14.4.7
NIST 800-171 3.13.1
CMMC SC.L2-3.13.1

How do I add it on my stack?

Check your site now

Free scan, instant grade, exact fixes for your stack.

Other security headers

Strict-Transport-Security — Forces browsers to only use HTTPS for your domain.
Content-Security-Policy — Controls which scripts, styles and frames a page may load.
X-Content-Type-Options — Stops browsers from guessing (sniffing) file types.
Referrer-Policy — Limits how much of your URLs leak to other sites.
Permissions-Policy — Turns off browser features (camera, mic, geolocation) you don't use.
Cross-Origin-Opener-Policy — Isolates your window from pop-ups and openers on other sites.
Cross-Origin-Resource-Policy — Stops other sites from loading your resources.
Cross-Origin-Embedder-Policy — Requires embedded resources to opt in (enables cross-origin isolation).