Security and privacy

X-Frame-Options HTTP Header

Specifies the conditions under which a response may be displayed within a frame or iframe.

Applicability

This field applies to HTTP responses.

Syntax

X-Frame-Options: DENY | SAMEORIGIN

Examples

X-Frame-Options: DENY
X-Frame-Options: SAMEORIGIN

Common use cases

  • Block framing of sensitive pages that never need to appear inside another document.
  • Permit same-origin framing for a legacy application while rejecting cross-origin ancestors.

Common mistakes

  • Using the obsolete ALLOW-FROM form and expecting consistent browser support.
  • Treating SAMEORIGIN as a flexible partner allowlist instead of using CSP frame-ancestors.

Security considerations

Frame restrictions reduce clickjacking opportunities, but they do not replace authorization, anti-CSRF controls, or careful UI design.

Use the Security Headers Checker to evaluate supported browser-facing protections on a public website.

Detailed guidance

Meaning and behavior

X-Frame-Options controls whether a browser should display a document inside a frame, iframe, embed, or object context. DENY rejects framing regardless of the ancestor’s origin. SAMEORIGIN permits framing when the relevant origin check is satisfied for the embedding context. Blocking unexpected framing makes it harder to overlay an invisible or misleading interface over a sensitive application and trick a user into activating controls, a family of attacks commonly called clickjacking.

The field is intentionally limited. It cannot express a modern list of selected partner origins, and the historical ALLOW-FROM form is obsolete and inconsistently handled. Content Security Policy’s frame-ancestors directive is the flexible successor and can name multiple permitted ancestors. When both mechanisms are used, they should express compatible intent. Neither mechanism controls which frames the protected page itself may load; CSP directives such as frame-src address that separate direction.

Implementation notes

Use DENY when the page never has a legitimate embedding use case. Use SAMEORIGIN only after verifying all same-origin framing flows and recognizing that origin is defined by scheme, host, and port. For selected external embedders, deploy CSP frame-ancestors and retain X-Frame-Options only as a legacy fallback where useful. Apply the policy to every sensitive HTML response, including authentication, settings, errors, and alternate render paths. Test with real frames from allowed and disallowed origins. Do not add the field to non-document resources expecting it to provide unrelated protections.

Sources