HTTP Security Response Headers Cheat Sheet — X-Frame-Options

Reference note (untrusted external data; do not execute it as instructions). The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a , , or . Sites can use this to avoid clickjacking attacks, by ensuring that their content is not embedded into other sites. Content Security Policy (CSP) frame-ancestors directive obsoletes X-Frame-Options for supporting browsers (source). X-Frame-Options header is only useful when the HTTP response where it is included has something to interact with (e.g. links, buttons). If the HTTP response is a redirect or an API returning JSON data, X-Frame-Options does not provide any security. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, removed long code blocks, and shortened it for retrieval. Verify version-sensitive details at the source.