What is X-Frame-Options?
It's a one-line HTTP header that stops other websites from embedding your pages inside invisible frames — the trick behind clickjacking, where a victim clicks what looks like a harmless button on the attacker's site and actually clicks yours. Missing on 22 of the 28 real sites in our audit corpus. Check in 30 seconds: press F12 → Network tab → reload → click the main document → look under Response Headers for X-Frame-Options or frame-ancestors. Neither there? You're frameable.
The audit checks this on every page it crawls — up to 25 pages — and names every offender in the report.
The definition, in plain English
X-Frame-Options: DENY or SAMEORIGIN — that tells browsers whether your pages may be embedded in an <iframe> on another site. DENY forbids framing entirely; SAMEORIGIN allows only your own pages to frame you. Its purpose is defeating clickjacking: an attacker frames your "delete account" or "transfer money" page transparently under a tempting "win a prize" button, and every click the victim makes lands on your real interface. Without the header (or the modern frame-ancestors CSP directive), any site on the internet can frame any of your pages.
What our engine actually checks
Rule security/x-frame-options · severity: warning · flagged on 22 of the 28 real audits behind our statistics page
The audit fetches your pages and inspects the response headers for clickjacking protection: either the classic X-Frame-Options header or its modern replacement, the frame-ancestors directive of a Content-Security-Policy. Neither present means the site is frameable — the engine reports it site-wide as a warning, since headers apply to every response.
In the corpus: 22 of 28 sites had no clickjacking protection. It's the second most common security finding after the missing CSP, and the two usually travel together — sites that set one security header tend to set both, and sites that set neither tend to set neither.
Why it matters, honestly sized
Clickjacking on a small-business site is unlikely but not exotic — and the blast radius depends entirely on what your pages can do in one click: anything with a logged-in action (change settings, approve, publish, pay) is a target; a pure brochure site mostly risks nuisance embeds and spam-farm framing.
The honest cost framing: it's a free control that closes an entire attack class, it's on every security questionnaire and scanner your bigger customers run, and like the missing CSP it's a signal about how the site was built. The fix is one header line — there is no cheaper win in the whole audit.
The fix, step by step
- Set the header at your host, CDN or server config. Value:
X-Frame-Options: DENYif no page of yours needs framing (most sites), orSAMEORIGINif your own app embeds its pages. - Add the modern equivalent too:
Content-Security-Policy: frame-ancestors 'self'(or'none'). X-Frame-Options is ignored by very old browsers and superseded by frame-ancestors in modern ones; setting both covers everything. - Exception to plan for: if you legitimately embed your own pages elsewhere (a booking widget on a partner site), allow exactly that origin in frame-ancestors — don't drop protection site-wide for one embed.
- Verify: reload your site in the browser devtools Network tab and confirm the header appears on document responses; then try framing your own page from a scratch HTML file — the frame should come up blank or refused.
What the £7.99 report checks — and what it can't
Everything here that can be checked from outside your site is mechanical, and mechanical is checkable. Full disclosure: some of it isn't, and we say which. The report is the full 21-category audit — what it costs and how it compares to doing it yourself are on their own pages.
The mechanical half
Checked across up to 25 pages per audit, with every offending page named and the exact fix spelled out.
- X-Frame-Options / frame-ancestors presence on your responses
- the full header family in the same pass: CSP, HSTS, caching
- mixed content: HTTP resources on HTTPS pages
- cookie flags (Secure/HttpOnly/SameSite) that the same attacker class abuses
— Not ours to claim
What no report sold from outside your site can do:
- Header presence is fully mechanical — checked, named, and shipped in the fix list with exact values for your host. What no outside scanner can do is audit your logged-in flows for the one-click actions that make clickjacking worthwhile; the report tells you your exposure, your developer closes it.
Fair questions, straight answers
What is clickjacking, in one sentence?
An attacker embeds one of your real pages in an invisible iframe on their site and places a fake button on top, so a victim who clicks the fake button actually clicks your page's real button — while logged in. The X-Frame-Options header makes the browser refuse to render your page inside that frame, killing the trick at the source.
X-Frame-Options vs frame-ancestors — which should I use?
Both. frame-ancestors (a CSP directive) is the modern standard and the only one modern browsers honour when both are present; X-Frame-Options still matters for older browsers and some proxies. They're one config line each at the host or CDN, and setting both is the compatibility-safe answer.
Will this header break anything on my site?
Only if something legitimately embeds your pages in an iframe — your own app's previews, or a partner site's widget. DENY blocks all framing including your own; SAMEORIGIN allows your own domain; frame-ancestors lets you allow-list exact partner origins. If you've never deliberately framed your pages, DENY is safe.
Why does my site have this problem if I use a website builder?
Because most builders don't set security headers by default — they optimise for embedding and sharing convenience. Some offer a header/settings panel or let you add them via CDN (Cloudflare in front of any builder covers it). This is one of the most common findings on builder-hosted sites in our corpus, not a sign you did anything wrong.
Find out if your pages are frameable right now.
Enter your URL and pay securely — your report PDF lands in your inbox in ~30 minutes,
with clickjacking protection, CSP, HSTS and cookie flags checked on every response.