Matan · Security · Headers

Clickjacking protection

X-Frame-Options or CSP frame-ancestors stops other sites from framing you.

Pass condition in our engine: X-Frame-Options or CSP frame-ancestors is set.

1. Problem description

Framing enables clickjacking (UI redress). If you must allow a partner to embed you, list them in frame-ancestors rather than using *.

2. Most common causes

  • Default nginx config without either header.
  • frame-ancestors * which allows everyone.

3. How to fix it

  1. Add Content-Security-Policy: frame-ancestors 'self' (preferred).
  2. Or X-Frame-Options: DENY / SAMEORIGIN.
  3. Do not send conflicting allow-all values.

Test this check

We fetch only this URL (plus robots.txt / llms.txt at the domain root when the check needs them). We do not crawl the rest of the site like a full report.

Scoring rules for the full site crawl are documented in methodology. Want every category at once? Generate a free report.

Get your free SEO & GEO report

Enter your URL and receive a full audit with scoring and recommendations. No sign-up required.

Generate a free reportView sample report