Missing X-Frame-Options header

LowAuto-fixableSecurityPer-page checksecurity_no_xframe

What this means

The response does not send X-Frame-Options, so the page can be embedded in a frame on another site, which enables clickjacking.

How to fix it

Send X-Frame-Options: SAMEORIGIN (or DENY if the page is never framed), or the equivalent CSP frame-ancestors directive.

Fix effort

This check is auto-fixable: the change can be written and validated automatically, so CrawlX can open it as a pull request for review.

Authoritative source

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers

Related checks

More in Security

Redirect downgrades HTTPS to HTTP Mixed content on an HTTPS page Content-Security-Policy is report-only Missing Content-Security-Policy header Missing HSTS header All checks

Find every page this affects

CrawlX runs this check — and 161 others — across your whole site, ranks the findings by estimated impact, and opens the fixable ones as pull requests. Free for 500 URLs.

Start crawling free Browse all checks