The X-Frame-Options header tells the browser whether other websites are allowed to display your pages inside a frame or iframe. It exists because framing is the mechanism behind clickjacking, where a visitor believes they are interacting with one site while actually clicking controls on another.
It is a simple header with only two values worth using today, and a more flexible modern successor in Content-Security-Policy.
There are two supported values in practice:
An older ALLOW-FROM value was intended to name a single permitted site. It is obsolete and is not honoured by current browsers, so setting it does not achieve what it looks like it achieves. If you find it configured on a site, treat that framing control as ineffective and replace it.
The Content-Security-Policy directive frame-ancestors covers the same ground with more precision: it can list multiple permitted origins, which X-Frame-Options never managed. Where both are present, current browsers give precedence to frame-ancestors.
Many sites keep X-Frame-Options for older clients and add frame-ancestors as the authoritative rule. If you need to allow a specific partner site to embed your pages, frame-ancestors is the correct tool.
Open DevTools with F12, use the Network tab, reload the page and inspect the document request's Response Headers for X-Frame-Options. Also check whether your Content-Security-Policy contains frame-ancestors, since that may be doing the real work.
The free website security check reports whether framing protection is present on your public pages so you can raise it with whoever maintains the site.
ScoutLab's free website security check looks at whether these headers are present and how they are configured on your public site, alongside HTTPS, DNS and email protection signals. It reports what it observes so you can discuss the results with whoever maintains your website.
Run the free website security checkIt is an HTTP response header that controls whether browsers may render your page inside a frame or iframe on another site. Restricting framing is the standard defence against clickjacking, where a visitor is tricked into clicking hidden controls layered under a page they trust.
The header itself is still honoured by browsers, but its ALLOW-FROM value is obsolete and the Content-Security-Policy frame-ancestors directive is the more capable modern control. Many sites send X-Frame-Options for compatibility while relying on frame-ancestors as the authoritative rule.
It is set wherever HTTP response headers are configured for your site: the web server configuration, the hosting platform's settings, a CDN or reverse proxy, or an application or CMS plugin. Whoever maintains your hosting will know which of these applies.
Use DENY when nothing should ever frame your pages, including your own site. Use SAMEORIGIN when your own pages embed each other in iframes. If a specific external partner must be allowed to embed your site, use CSP frame-ancestors instead, since X-Frame-Options cannot express that.
Security headers are browser-facing HTTP response controls and one layer of defence. They work alongside patching, access control, backups and monitoring rather than replacing them.
