Web security

Clickjacking protection (X-Frame-Options / frame-ancestors)

Security headers, HTTPS enforcement, cookies and cross-origin rules of the website.

Why it matters

Other sites can load your pages in an invisible frame and trick users into clicking buttons they cannot see (clickjacking) - for example confirming a payment or changing settings.

How to fix it

Quick fix · under 1 hour

Add the header in the web server (or CDN) configuration of the site.
Use SAMEORIGIN instead of DENY if your own site frames its pages.
Reload the web server and re-run the scan to confirm.

nginx

add_header X-Frame-Options "DENY" always;

Apache

Header always set X-Frame-Options "DENY"

All recommended headers (nginx)

# inside the server { } block that serves HTTPS
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

Test this now, free: Security headers checker - no sign-up.

How we test it

The check runs from the public internet as part of every scan, read-only and without touching your data. If it fails, your report shows the evidence that proves it - the record, header, file or banner we observed - together with the fix above, tailored to the issue we found.

Does your domain pass this check?

Run all 97 checks in about a minute. Your first scan is free, with the complete fix for your most urgent finding.

Scan your domain free