X-Frame-Options header not set

What it means in plain English

X-Frame-Options is a response header that says whether a browser may show your page inside a <frame>, <iframe>, <embed>, or <object>. MDN says sites use it "to avoid clickjacking attacks and some cross-site leaks."

MDN also says: "If this header is not sent, and the website has not implemented any other mechanisms to restrict embedding (such as the frame-ancestors CSP directive), then the browser will allow other sites to embed this document." That is what the scanner is flagging.

Likely causes

• The host was never told to send the header.
• The header was put in a <meta> tag. MDN: "Setting X-Frame-Options inside the <meta> element ... has no effect."
• The header uses ALLOW-FROM. MDN calls it obsolete and says modern browsers that see it "will ignore the header completely."

How to fix it, step by step

1. Decide whether any page of yours must appear in a frame. If none, use DENY. If only your own site frames it, use SAMEORIGIN.
2. Add the header to every path:

X-Frame-Options: DENY

3. Where to add a response header:

   • Vercel: the headers list in vercel.json, with a source pattern such as /(.*) and a list of key and value pairs.
   • Netlify: a plain text _headers file in the publish directory, or [[headers]] in netlify.toml. Netlify says custom headers don't apply to content handled by a function or edge function, such as a server-rendered page, or to proxied content. Those must return the header themselves.
   • Your own server: set it in the web server config. MDN's X-Frame-Options page shows Apache, Nginx, and IIS examples.

4. If specific other sites must embed the page, use the CSP frame-ancestors directive instead, for example Content-Security-Policy: frame-ancestors 'self' https://partner.example.com. MDN says frame-ancestors 'none' "is similar to X-Frame-Options: deny," and X-Frame-Options is also supported in older browsers, so sending both is common.

5. Redeploy and check the document response headers.

How to check it worked

• The document response includes X-Frame-Options: DENY or SAMEORIGIN, or a CSP with frame-ancestors.
• A test page on another site that frames yours shows a blank frame.

To add a full policy, see Content Security Policy header not set.

Questions people ask

Should I use DENY or SAMEORIGIN for X-Frame-Options?

DENY blocks every frame, including frames on your own site. SAMEORIGIN allows embedding only when all ancestor frames have the same origin as the page.

Does X-Frame-Options work in a meta tag?

No. MDN says setting X-Frame-Options inside a meta element has no effect. It is only enforced as an HTTP response header.

X-Frame-Options vs Content Security Policy frame-ancestors: which should I use?

MDN points to frame-ancestors for more options, such as listing the sites that may embed the page. Setting frame-ancestors to 'none' is similar to X-Frame-Options DENY, which older browsers also support.

Sources

• https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options (opens in a new tab)
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-ancestors (opens in a new tab)
• https://vercel.com/docs/project-configuration/vercel-json (opens in a new tab)
• https://docs.netlify.com/manage/routing/headers/ (opens in a new tab)