Skip to main content
SlapMyWeb
Slap a site
Fix Guide

How to Stop Your Site Being Framed

Block clickjacking by declaring who may embed your pages in an iframe.

Easy Medium Impact 15 min

Without a framing policy, any site can load yours in an invisible iframe and trick a visitor into clicking something they cannot see — clickjacking. The modern fix is a Content-Security-Policy frame-ancestors directive, with X-Frame-Options as a fallback for older browsers. Both are single response headers.

Why It Matters

Clickjacking targets authenticated actions: a hidden frame over a bait page turns an innocent click into a real action on your site. The defence is one header, and it is missing far more often than it should be.

How to Fix

1

Set frame-ancestors in CSP

frame-ancestors 'none' blocks all framing; 'self' allows your own origin; list specific origins where a partner must embed you.
2

Add X-Frame-Options too

DENY or SAMEORIGIN, for browsers that predate frame-ancestors. Where both are present, CSP wins.
3

Set it at the edge

Send it from the server, proxy or CDN so every response carries it, including static files and error pages.
4

Check what you actually embed

If your own pages are framed legitimately — a dashboard in an app, a widget on a customer's site — list those origins rather than blocking everything.

Code Fix

text
Before (broken)
curl -sI https://example.com | grep -i -E 'frame|content-security'
(no output)
After (fixed)
Content-Security-Policy: frame-ancestors 'self'
X-Frame-Options: SAMEORIGIN

Platform-Specific Instructions

WordPress

Add the headers in the server config rather than a plugin, so they apply to every response including uploads.

Next.js

Set them in the headers() function in next.config, or at the proxy if one terminates TLS in front.

Fixed that one.
Now find the rest.

A free audit ranks every issue on your site by the score points it costs — and links each one straight to its guide.

Run a free audit
Free foreverNo signupResults in 30s