X-Frame-Options

`X-Frame-Options` is an HTTP response header that asks supporting browsers to restrict whether a document can be embedded in a `<frame>`, `<iframe>`, `<embed>`, or `<object>`. `DENY` blocks both same-origin and cross-origin framing; `SAMEORIGIN` permits framing only when every ancestor frame has the same origin. The obsolete `ALLOW-FROM` directive is ignored by modern browsers. CSP `frame-ancestors` is the more flexible current control.

Why it matters: Decide which pages genuinely need embedding before choosing a policy. Pages with sensitive or consequential controls often need `DENY` or a narrowly scoped CSP `frame-ancestors` list, while dashboards, widgets, payment flows, or partner portals may require approved ancestors. Deliver the policy as an HTTP response header; an `X-Frame-Options` meta element has no effect, and CSP `frame-ancestors` also cannot be delivered through meta. Test direct visits, every permitted nested ancestor, sign-in and payment journeys, multiple browser families, redirects, errors, CDN responses, and reports. Where modern CSP support is sufficient, use `frame-ancestors`; a compatible X-Frame-Options value can provide older-browser coverage, but an enforced `frame-ancestors` directive overrides it. Framing restrictions reduce exposure to many clickjacking scenarios but do not replace authorization, CSRF defences, transaction confirmation, or broader UI-redressing analysis.