Cybersecurity glossary
What is X-Frame-Options?
Learn what the X-Frame-Options header does, how DENY and SAMEORIGIN block framing, how it relates to CSP frame-ancestors, and how to prevent clickjacking.
Definition
X-Frame-Options is an HTTP response header that controls whether a browser may render a page in a frame, iframe, embed, or object—historically used as a primary defense against clickjacking by restricting who can embed the page.
Why framing control matters
If an attacker can iframe your banking UI under transparent overlays, users may click “Transfer” while thinking they clicked something else. X-Frame-Options was the first widely deployed browser header to stop that class of clickjacking.
Header values
| Value | Meaning |
|---|---|
| DENY | No framing allowed, even from the same origin |
| SAMEORIGIN | Framing allowed only by same-origin ancestors |
| ALLOW-FROM uri | Obsolete; do not rely on it |
Modern guidance: pair with CSP
Identify pages that must never be framed
Auth, account, and payment flows are typical DENY candidates.
Set X-Frame-Options
Use DENY or SAMEORIGIN as a compatibility layer.
Add CSP frame-ancestors
Express allowlists with the modern directive for supporting browsers.
Test embedding needs
Partner integrations that require framing need explicit, reviewed exceptions.
Clickjacking defense
Primary historical purpose—block hostile iframes.
Defense in depth
Works alongside UI confirmations for sensitive actions.
Simple to deploy
One header at the edge or app middleware.
Limited expressiveness
CSP frame-ancestors handles complex allowlists better.
- Send X-Frame-Options: DENY or SAMEORIGIN on sensitive pages.
- Prefer CSP frame-ancestors for modern framing policy.
- Avoid ALLOW-FROM; it is not a reliable control.
- Review any product requirement to allow third-party embedding.
- Test with iframes from foreign origins in QA.
- Ensure CDNs and gateways do not strip framing headers.
- Combine with user confirmation for high-risk actions.
- Document exceptions so they do not silently become permanent.
The practical takeaway
X-Frame-Options restricts who can embed your pages in frames, mitigating clickjacking. Keep it for compatibility, and use CSP frame-ancestors as the primary modern policy.
If a page can move money or change security settings, default to “not frameable” unless you have a strong, reviewed reason otherwise.
Related security terms
Clickjacking
The UI redressing attack X-Frame-Options was designed to mitigate.
Content Security Policy (CSP)
frame-ancestors is the modern replacement/enhancement for framing control.
X-Content-Type-Options
Another baseline browser security header.
X-XSS-Protection
A legacy XSS filter header with different goals and caveats.
Frequently asked questions
What does X-Frame-Options do?
It tells browsers whether your page may be embedded in frames on other sites, helping stop clickjacking.
What values are used?
DENY blocks all framing. SAMEORIGIN allows framing only by pages from the same origin. ALLOW-FROM is obsolete and poorly supported.
Is X-Frame-Options still recommended?
It remains widely used, but CSP frame-ancestors is the modern, more flexible standard. Many sites send both during transition.
Does SAMEORIGIN allow sibling subdomains to frame?
No. Same origin means scheme, host, and port—not just the registrable domain.
Can attackers bypass X-Frame-Options?
Older tricks existed in some browsers; keep browsers updated and prefer CSP frame-ancestors for stronger control.
Should login and payment pages set DENY?
Usually yes, unless you have a deliberate, reviewed need to embed them.
References
Explore authoritative guidance and frameworks related to x-frame-options.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.