X-Frame-Options Checker
Verify your clickjacking protection by checking the X-Frame-Options header or Content Security Policy frame-ancestors directive. This tool tells you if your site can be embedded in malicious iframes and shows you how to prevent it.
What is X-Frame-Options?
X-Frame-Options is an HTTP response header that controls whether a browser is allowed to render your page inside an iframe, frame, or object. It prevents clickjacking (UI Redressing) attacks where attackers embed your site in an invisible iframe and trick users into clicking on elements they can't see. The modern alternative is the CSP frame-ancestors directive, which provides more granular control.
Why It Matters
Clickjacking attacks have been used to steal money from banking customers, steal OAuth tokens, enable unauthorized social media actions, and capture sensitive form submissions. Any site with authenticated user actions — banking, social media, admin panels, ecommerce checkout — is a potential clickjacking target. The fix is trivial: a single header line.
Common Configuration Mistakes
- ✗Using ALLOW-FROM (deprecated in modern browsers — use CSP frame-ancestors instead)
- ✗Setting X-Frame-Options: ALLOWALL (invalid, treated as DENY by some browsers)
- ✗Not applying the header to all pages — only protecting the homepage
- ✗Forgetting that APIs and admin panels also need framing protection
- ✗Configuring both X-Frame-Options and CSP frame-ancestors inconsistently
Recommended Configuration
X-Frame-Options: SAMEORIGIN # Or using CSP (preferred for modern browsers): Content-Security-Policy: frame-ancestors 'self';
Frequently Asked Questions
Should I use X-Frame-Options or CSP frame-ancestors?
Use CSP frame-ancestors for modern sites — it provides more granular control and supersedes X-Frame-Options in modern browsers. For maximum compatibility, set both. The CSP directive takes precedence in browsers that support it.
What is the difference between DENY and SAMEORIGIN?
DENY prevents any site including your own from embedding your page. SAMEORIGIN allows embedding only from the same origin. Use DENY if you have no legitimate need for iframes. Use SAMEORIGIN if your own pages embed each other.
Does X-Frame-Options protect against all clickjacking?
It protects against iframe-based clickjacking. It does not protect against other UI redressing techniques like CSS pointer-events manipulation or touch event hijacking on mobile.
Related Tools & Guides
Need Professional Web Application Security Testing?
This scanner checks visible headers. VAPT Experts provides professional web application penetration testing, API security testing, and compliance-ready security reports.
Request VAPT Assessment