SSL & Security

X-Frame-Options Checker

Clickjacking

Check X-Frame-Options header

Enter your domain name to check if the X-Frame-Options header is set for your website.

Tool features

Comprehensive X-Frame-Options header analysis and security assessment
4 checks

Clickjacking Protection

Verify if your website is protected against clickjacking attacks

Header Analysis

Comprehensive HTTP header analysis and security assessment

Security Assessment

Check X-Frame-Options header configuration and recommendations

Frame Embedding Check

Ensure your site cannot be embedded in malicious frames

What is X-Frame-Options & how it works

How the header blocks clickjacking via framing

X-Frame-Options is an HTTP response header that controls whether a browser may render your page inside a <frame>, <iframe> or<object>. Its job is to stop clickjacking — an attack that layers your real page invisibly over a decoy so victims click things they never intended to.

The header takes DENY (never allow framing) or SAMEORIGIN (allow only your own site). This checker fetches your site's headers and reports whether X-Frame-Options is present and how it's configured. The modern successor is the CSP frame-ancestors directive, which is more flexible and should be used alongside it.

DENY
The page can never be framed, by any site including your own.
SAMEORIGIN
Only pages from the same origin may frame this page.
frame-ancestors
The CSP directive that supersedes X-Frame-Options with finer control.

How to use this tool

Check a site's X-Frame-Options in four steps
1
Enter a domain
Type a domain, e.g. example.com — the tool requests it over HTTPS.
2
Run the check
Click Check X-Frame-Options to fetch the response headers for the site.
3
Read the verdict
See whether the header is present and its value (DENY or SAMEORIGIN), plus every other header.
4
Fix if missing
If it is absent, add X-Frame-Options and a CSP frame-ancestors directive, then re-check.

Related tools

Keep debugging with tools from the same suite
5 tools
OCSP Checker
Check SSL certificate revocation status using the Online Certificate Status Protocol (OCSP)
Secure Header Checker
Check security headers like CSP, HSTS, X-Frame-Options, and more with security scoring
HSTS Checker
Check HTTP Strict Transport Security (HSTS) header configuration and preload status
HTTP Header Checker
Analyze HTTP response headers for any website or URL with detailed header information
CORS Headers Checker
Check and analyze Cross-Origin Resource Sharing (CORS) headers for security configuration

Frequently asked questions

Common questions about X-Frame-Options
5 Q&A

X-Frame-Options is an HTTP response header that tells browsers whether your page may be embedded in a frame or iframe. It defends against clickjacking by preventing your site from being framed by attackers.

The two supported values are DENY (the page may never be framed) and SAMEORIGIN (only pages from the same origin may frame it). The older ALLOW-FROM value is deprecated and ignored by modern browsers.

Clickjacking is an attack that loads your real page invisibly on top of a decoy, tricking users into clicking buttons or links they cannot see. Framing protection like X-Frame-Options prevents your page from being used this way.

Use both. CSP frame-ancestors is the modern, more flexible replacement, but X-Frame-Options is still honoured by older browsers. Setting both gives the widest protection.

Set it at your web server or app — for example add_header X-Frame-Options "SAMEORIGIN" in Nginx, or Header set X-Frame-Options "SAMEORIGIN" in Apache — then reload. Add a matching Content-Security-Policy: frame-ancestors directive too.