The X-Frame-Options header prevents clickjacking attacks by telling browsers whether your page is allowed to be displayed inside an <iframe>, <frame>, or <embed> element. This guide shows how to set it on every major web server and platform.
Choosing the Right Value
| Value | Effect | When to Use |
|---|---|---|
DENY | No framing by anyone, including same origin | Default for most sites — use unless you embed your own pages in iframes |
SAMEORIGIN | Framing allowed by same-origin pages only | When your own application legitimately uses iframes across pages |
Also Set CSP frame-ancestorsFor modern browsers, combine X-Frame-Options with
Content-Security-Policy: frame-ancestors 'none' (equivalent to DENY). CSP is the modern standard; X-Frame-Options covers legacy IE11 as a fallback.Set the Header on Your Server
Nginx
nginx
server {
listen 443 ssl;
server_name example.com;
add_header X-Frame-Options "DENY" always;
# ... rest of config
}Test and reload:
bash
sudo nginx -t && sudo systemctl reload nginxApache
Ensure mod_headers is enabled (sudo a2enmod headers), then:
apache
<VirtualHost *:443>
<IfModule mod_headers.c>
Header always set X-Frame-Options "DENY"
</IfModule>
</VirtualHost>Or in .htaccess:
apache
<IfModule mod_headers.c>
Header always set X-Frame-Options "DENY"
</IfModule>bash
sudo systemctl reload apache2IIS
xml
<system.webServer>
<httpProtocol>
<customHeaders>
<add name="X-Frame-Options" value="DENY" />
</customHeaders>
</httpProtocol>
</system.webServer>Caddy
Command
example.com {
header X-Frame-Options "DENY"
# ... rest of config
}Cloudflare
- Go to Rules → Transform Rules → Modify Response Header.
- Add a rule with Operation: Set, Header name: X-Frame-Options, Value: DENY.
- Deploy the rule.
Next.js
javascript
// next.config.mjs
const nextConfig = {
async headers() {
return [
{
source: '/(.*)',
headers: [
{ key: 'X-Frame-Options', value: 'DENY' },
],
},
];
},
};
export default nextConfig;Verifying the Header
bash
curl -I https://example.com | grep -i x-frame-options
# Expected: x-frame-options: DENYOr use the ShowDNS Security Headers Scanner.