X‑Frame‑Options is an HTTP response header used to indicate whether a browser should be allowed to render a page in a <frame>, <iframe>, <embed>, or <object>. It helps prevent clickjacking attacks by ensuring that your site is not embedded in malicious frames.
Values: DENY, SAMEORIGIN, ALLOW-FROM uri

Clickjacking tricks users into clicking on something different from what they perceive. Attackers overlay transparent or disguised iframes over legitimate buttons, potentially hijacking clicks to perform unintended actions (like changing settings, approving transactions, or sharing private data).

Both provide clickjacking protection, but Content Security Policy (CSP) frame-ancestors is more flexible and modern. It allows you to specify multiple allowed sources (or 'none'), while X‑Frame‑Options only supports one URI or SAMEORIGIN. Most modern browsers honor CSP; however, it’s recommended to use both headers for maximum compatibility.

All modern browsers (Chrome, Firefox, Safari, Edge) have supported X‑Frame‑Options for many years. Legacy IE also supports it. It remains a widely adopted security header, but for robust defense, combine it with CSP frame-ancestors.

Add the following HTTP response headers on your web server or application:
X‑Frame‑Options: DENY (most strict)
Content-Security-Policy: frame-ancestors 'none';
For same-origin only: X-Frame‑Options: SAMEORIGIN and frame‑ancestors 'self'.
Consult your server documentation (Apache, Nginx, IIS) or framework middleware for implementation.

Browser security (CORS) blocks front‑end requests to arbitrary websites. This tool works best with a backend proxy (API endpoint on your server). If the test fails, use a browser developer tool (Network tab) to inspect the response headers manually, or deploy our open‑source proxy script.