Skip to main content
SlapMyWeb
Slap a site

Security fix

How to Stop Your Site Being Framed

Block clickjacking by declaring who may embed your pages in an iframe.

Difficulty
Easy
Impact
Medium
Time
15 min

Before

curl -sI https://example.com | grep -i -E 'frame|content-security'
(no output)

After

Content-Security-Policy: frame-ancestors 'self'
X-Frame-Options: SAMEORIGIN
Before and after code for: How to Stop Your Site Being Framed

Without a framing policy, any site can load yours in an invisible iframe and trick a visitor into clicking something they cannot see: clickjacking. The modern fix is a Content-Security-Policy frame-ancestors directive, with X-Frame-Options as a fallback for older browsers. Both are single response headers.

Why it matters

Clickjacking targets authenticated actions: a hidden frame over a bait page turns an innocent click into a real action on your site. The defence is one header, and it is missing far more often than it should be.

How to fix it

  1. Set frame-ancestors in CSP

    frame-ancestors 'none' blocks all framing; 'self' allows your own origin; list specific origins where a partner must embed you.

  2. Add X-Frame-Options too

    DENY or SAMEORIGIN, for browsers that predate frame-ancestors. Where both are present, CSP wins.

  3. Set it at the edge

    Send it from the server, proxy or CDN so every response carries it, including static files and error pages.

  4. Check what you actually embed

    If your own pages are framed legitimately, a dashboard in an app, a widget on a customer's site, list those origins rather than blocking everything.

The code

Beforetext
curl -sI https://example.com | grep -i -E 'frame|content-security'
(no output)
Aftertext
Content-Security-Policy: frame-ancestors 'self'
X-Frame-Options: SAMEORIGIN

On your platform

WordPress

Add the headers in the server config rather than a plugin, so they apply to every response including uploads.

Next.js

Set them in the headers() function in next.config, or at the proxy if one terminates TLS in front.

Sources

More fixes

Security

How to Add X-Content-Type-Options: nosniff

Stop browsers from MIME-sniffing responses: a one-line header that closes an XSS vector.

Security

How to Add a Permissions-Policy Header

Restrict which browser features (camera, mic, geolocation) the page and its iframes can use.

Security

How to Secure Cookies (Secure, HttpOnly, SameSite)

Add the flags that stop cookies being stolen over HTTP, via XSS, or in CSRF attacks.

Fixed that one.
Now find the rest.

A free audit ranks every issue on your site by the score points it costs, and links each one straight to its guide.

Run a free audit
Free foreverNo signupLive scan progress