HTTP headers
X-Frame-Options HTTP Header Meaning
X-Frame-Options controls whether a page can be embedded in a frame.
Meaning
The server is using a legacy clickjacking defense for frame embedding.
Where it appears
Older applications and simple sites send it to block or restrict framing.
What to check
Prefer CSP frame-ancestors for modern control, and avoid relying on ALLOW-FROM.
Example
X-Frame-Options: DENYCommon values and directives
DENY- Do not allow the page to be shown in a frame.
SAMEORIGIN- Allow framing only by pages from the same origin.
References
- Registry
- IANA HTTP Field Name Registry
- Guide
- MDN X-Frame-Options