P2 · MediumSecurity
Missing X-Frame-Options
Page can be embedded in frames
Code: missing_x_frame_options
Why it matters
Page can be embedded in frames. Browsers and users expect sites to be secure. Missing protections expose visitors to data theft, phishing, and loss of trust.
How to fix
Add X-Frame-Options header
http# Nginx — add inside your server {} block
add_header X-Frame-Options "DENY" always;
# Apache — add to .htaccess or <VirtualHost>
Header always set X-Frame-Options "DENY"Related checks in Security
Run a free scan to check your site
Get a complete audit in under 2 minutes. No account required.
Start Free Scan