Security headers

Control which sites can embed yours

Why this matters

Another site could display your page inside a frame and trick visitors into clicking it. A frame is a page shown inside another page.

What to do

1. Check whether any legitimate service needs to display your site inside its own page.
2. If none does, ask your host to add X-Frame-Options: DENY. An alternative is frame-ancestors 'self' within Content-Security-Policy, which allows pages on your own site to embed it.
3. What to tell your web developer: Please prevent unwanted framing using X-Frame-Options: DENY or frame-ancestors 'self' in the content security policy. Check any legitimate embedding before choosing the rule. These are response headers, or instructions sent by the server.

How to check the fix

Run the checker again and look for a pass for framing protection. Ask your developer to confirm that the chosen rule also preserves any intended embedding.