Security
Stop other sites hiding your pages in a frame
Your pages can be embedded inside a frame on someone else page, which lets an attacker disguise your buttons as theirs.
Why it matters
If your site can be loaded in a frame, another site can place it invisibly under its own content. A visitor thinks they are clicking a game or a close button and is actually clicking something on your site. This header takes one line and closes that trick off.
How you would notice it
- A security scan reported the site can be framed.
- Your login or contact form could be reproduced on another domain.
What to do
Stage 1
- Choose your approach. X-Frame-Options is understood by every browser; a Content-Security-Policy frame-ancestors rule is the modern equivalent and is more precise.
- Add the simpler header first if you want the smallest change.
SAMEORIGIN lets your own site frame itself, which some themes need. DENY blocks framing entirely.
# nginx
add_header X-Frame-Options "SAMEORIGIN" always;Stage 2
- If you already publish a Content-Security-Policy, add the directive there instead.
frame-ancestors takes precedence over X-Frame-Options in browsers that understand it.
# nginx
add_header Content-Security-Policy "frame-ancestors 'self';" always;Stage 3
- If a third party legitimately embeds you, such as a booking widget, name that domain instead of self.
# nginx
add_header Content-Security-Policy "frame-ancestors 'self' https://booking.example.com;" always;How to check it worked
Confirm it worked
Use an online frame checker against your address and confirm it reports that framing is blocked. Re-run the Siege Test and confirm the clickjacking recommendation is gone.