EngineeringScoreSecurity Small
Add clickjacking protection
Clickjacking protection stops another site from loading your page inside an invisible or disguised iframe and tricking a visitor into clicking something they cannot see: a "Confirm Purchase" or "Delete Account" button, for example, hidden under a decoy UI. X-Frame-Options and the CSP frame-ancestors directive both control who is allowed to embed a page in a frame.
Why it matters
Without clickjacking protection, an attacker can embed the site in an invisible iframe and trick users into clicking real buttons (like "confirm payment") while they believe they are interacting with another page.
How to fix
- 1 Add X-Frame-Options: DENY (or SAMEORIGIN) or a CSP frame-ancestors directive.
- 2 Test that any legitimate embedding use cases still work.
Common mistakes
- Setting X-Frame-Options: DENY on a page that legitimately needs to be embedded elsewhere (a widget, an OAuth popup), breaking that functionality.
- Relying on client-side "frame-busting" JavaScript instead of a header, which determined attackers can strip out or work around.
- Setting both X-Frame-Options and a conflicting CSP frame-ancestors directive, which can behave inconsistently across browsers.
How to verify
- 1 Inspect the response headers for X-Frame-Options or a CSP frame-ancestors directive.
- 2 Attempt to embed the page in a test iframe on another domain and confirm the browser refuses to render it.
- 3 Confirm any legitimate embedding use case (widgets, partner integrations) still works after the header is added.
Related checks
Ready to see where you stand?
Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.