Block clickjacking (framing)

Web headers · about 5 min

In plain words

Clickjacking hides your real page inside an invisible frame on a malicious site, so visitors click your buttons without knowing it.

What can go wrong

Users can be tricked into changing settings, approving payments or deleting data while logged in.

How to fix it

Pick the platform your site runs on. Not sure? Forward this page to whoever manages your website.

Nginx

# inside the server { } block
add_header X-Frame-Options "DENY" always;

Apache / .htaccess

<IfModule mod_headers.c>
  Header always set X-Frame-Options "DENY"
</IfModule>

Cloudflare

Rules → Transform Rules → Modify Response Header
  Set static: X-Frame-Options = DENY

# Cloudflare Pages: add to public/_headers
/*
  X-Frame-Options: DENY

Vercel

// vercel.json
{ "headers": [ { "source": "/(.*)", "headers": [
  { "key": "X-Frame-Options", "value": "DENY" }
] } ] }

Netlify

# public/_headers
/*
  X-Frame-Options: DENY

WordPress

// functions.php (child theme) — or use your security plugin's "HTTP headers" setting
add_action('send_headers', function () {
  header('X-Frame-Options: DENY');
});

Before you change anything: If you have a CSP, the modern equivalent is "frame-ancestors 'none'" (or 'self' if you frame your own pages). Use SAMEORIGIN instead of DENY if your site frames itself.

Check that it worked

Re-run the ProbeHunt check.

Re-run the free check

References

MDN: X-Frame-Options