X-Frame-Options
Stops other sites embedding your pages in a frame. Superseded by CSP frame-ancestors, but still worth setting for old browsers.
Recommended value
X-Frame-Options: DENY
What it does
Clickjacking works by loading your page in an invisible frame over a decoy, so the victim's clicks land on your interface while they think they are clicking something else.
Valid values are DENY and SAMEORIGIN. ALLOW-FROM was never widely implemented and is supported by no current browser — a policy relying on it is not protected at all.
CSP's frame-ancestors replaces this header and browsers that support it ignore X-Frame-Options completely. Setting both is fine and harmless; just know the CSP value is the one taking effect.
Sites sending this header
Found while scanning 188 well-known sites on 2026-08-04: