Skip to main content
protocols.pageprotocols.page

X-Frame-Options

SecurityActive

The X-Frame-Options header prevents a page from being embedded in iframes, frames, or objects on other origins – defending against clickjacking attacks. It is superseded by Content-Security-Policy frame-ancestors but remains widely used for browser compatibility.

X-Frame-Options: DENY | SAMEORIGIN

Description

X-Frame-Options controls whether a browser should allow a page to be rendered in a frame. DENY prevents all framing. SAMEORIGIN allows framing by the same origin. ALLOW-FROM (deprecated) allowed specific origins. Modern practice is to use CSP frame-ancestors instead, but X-Frame-Options is still valuable for older browsers.

Directives

DirectiveDescription
DENYThe page cannot be displayed in a frame, regardless of origin.
SAMEORIGINThe page can only be displayed in a frame on the same origin as the page itself.

Examples

Deny all frames
http
X-Frame-Options: DENY
Same origin only
http
X-Frame-Options: SAMEORIGIN

Related

Content-Security-Policy

Specification

RFC 7034 – X-Frame-Options specification →