X-Frame-Options header

Syntax

X-Frame-Options: DENY
X-Frame-Options: SAMEORIGIN

Directives

DENY

The page cannot be displayed in a frame, regardless of the site attempting to do so. Not only will the browser attempt to load the page in a frame fail when loaded from other sites, attempts to do so will fail when loaded from the same site.

SAMEORIGIN

The page can only be displayed if all ancestor frames have the same origin as the page itself. You can still use the page in a frame as long as the site including it in a frame is the same as the one serving the page.

ALLOW-FROM origin Deprecated

This is an obsolete directive. Modern browsers that encounter response headers with this directive will ignore the header completely. The Content-Security-Policy HTTP header has a frame-ancestors directive which you should use instead.

Examples

Configuring Apache

Header always set X-Frame-Options "SAMEORIGIN"

Header set X-Frame-Options "DENY"

Configuring Nginx

add_header X-Frame-Options SAMEORIGIN always;

add_header X-Frame-Options DENY always;

Configuring IIS

<system.webServer>
  …
  <httpProtocol>
    <customHeaders>
      <add name="X-Frame-Options" value="SAMEORIGIN" />
    </customHeaders>
  </httpProtocol>
  …
</system.webServer>

Configuring HAProxy

rspadd X-Frame-Options:\ SAMEORIGIN

http-response set-header X-Frame-Options SAMEORIGIN

Configuring Express

import helmet from "helmet";

const app = express();
app.use(
  helmet({
    xFrameOptions: { action: "sameorigin" },
  }),
);

Specifications

Browser compatibility

See also

• Content-Security-Policy directive frame-ancestors
• ClickJacking Defenses - IEBlog​ (external)
• Combating ClickJacking with X-Frame-Options - IEInternals​ (external)