What is X-Frame-Options?
X-Frame-Options is an HTTP response header that controls whether a browser is allowed to render a web page inside a frame, iframe, or object element, providing protection against clickjacking attacks.
How Does X Frame Options Work?
Clickjacking is an attack where a malicious site embeds your page in an invisible iframe and tricks users into clicking on it, potentially triggering unintended actions like changing account settings or making purchases. The X-Frame-Options header prevents this by instructing the browser to block rendering of the page in frames. It supports three directives: DENY (never allow framing), SAMEORIGIN (only allow framing by the same domain), and ALLOW-FROM (allow framing by a specific origin).
Setting the X-Frame-Options header is a straightforward security measure that can be configured in your web server settings, application code, or hosting control panel. While it has been largely superseded by the more flexible Content-Security-Policy frame-ancestors directive, X-Frame-Options remains widely used for backward compatibility with older browsers. It is considered a baseline security header that every website should implement.