X-Frame-Options headerWhat it checks and how to fix it

What it checks

Fetches the homepage and reads X-Frame-Options. A missing header fails, a value other than DENY or SAMEORIGIN (including the obsolete ALLOW-FROM) gets a warning, and DENY or SAMEORIGIN passes.

Why it matters

If other sites can load your pages in an iframe, they can lay invisible buttons over them and trick visitors into clicking things they did not intend (clickjacking): changing settings, confirming payments, granting permissions. X-Frame-Options tells the browser not to render your pages inside another site.

How to fix it

Send X-Frame-Options: SAMEORIGIN (or DENY if you never frame your own pages). For finer control, also set the CSP frame-ancestors directive, which modern browsers prefer.

nginx

add_header X-Frame-Options "SAMEORIGIN" always;
add_header Content-Security-Policy "frame-ancestors 'self'" always;

Apache

Header always set X-Frame-Options "SAMEORIGIN"

Cloudflare: Rules → Transform Rules → Modify Response Header → set X-Frame-Options to SAMEORIGIN.

Rails sends SAMEORIGIN by default; if it is missing, restore it in config/application.rb:

config.action_dispatch.default_headers["X-Frame-Options"] = "SAMEORIGIN"

If specific partners need to embed you, drop X-Frame-Options and use frame-ancestors 'self' https://partner.example instead.