Skip to content
DomainGrade

What we checkSecurity headersHD-03

Clickjacking protection

Stop other sites embedding yours in a hidden frame.

Area
Security headers
Check
HD-03
Included
Free in every scan

What we check

We look for frame-ancestors in your CSP, or an X-Frame-Options header, and accept either.

Why it matters

An attacker can load your site in an invisible frame over their own page and trick a logged-in visitor into clicking something they cannot see — a payment, a permission grant, a deletion.

The attack is called clickjacking and it needs nothing more than a transparent frame and a plausible page. The victim believes they are clicking a button on the attacker’s site; the click lands on yours, in their authenticated session.

This is one header and it has no compatibility cost for a site nobody legitimately embeds.

How to fix it

  1. 1

    Add frame-ancestors 'none' to your CSP.

  2. 2

    Keep X-Frame-Options: DENY alongside it for older browsers.

  3. 3

    If you have a legitimate embedder, name it instead of allowing everyone.

Both headers
Content-Security-Policy: frame-ancestors 'none'
X-Frame-Options: DENY

Common questions

Which takes precedence?
frame-ancestors wins wherever it is supported. X-Frame-Options is the fallback.
I need my site embeddable by a partner.
Use frame-ancestors https://partner.example — allow the specific origin rather than removing the protection.
Why is ALLOW-FROM not accepted?
It was never widely implemented and is ignored by every current browser, so a site relying on it has no protection at all.

See how your domain does on this check.

All 34 checks, a grade, and the exact fix for anything that isn’t right — in about twenty seconds, no signup.

Other security headers checks