Security Tools

X-Frame-Options Checker

Check whether a website sends an X-Frame-Options header to prevent clickjacking.

Enter a domain to check whether it sends an X-Frame-Options header.

More Security Tools

Content Security Policy (CSP) Checker X-Content-Type-Options Checker HSTS Checker Referrer-Policy Checker HTTPS Redirect Checker Permissions-Policy Checker Security Headers Checker CORS Header Checker

JustChecker monitors your security headers continuously and alerts you if any regress.

What Is X-Frame-Options?

The X-Frame-Options header controls whether other websites may show your page inside a frame. Blocking this prevents clickjacking, where attackers trick users into clicking hidden buttons on your site.

When to Use It

For sites with logins, payments or account settings.
During security reviews.

How to Use It

Enter the domain.
Check whether the header is present and its value.

Understanding the Result

DENY blocks all framing; SAMEORIGIN allows framing only by your own site. The modern equivalent is the CSP frame-ancestors directive, which browsers prefer when both exist.

Limitations

If your pages must be embedded by partner sites, use frame-ancestors with an allow-list instead of X-Frame-Options.

How Clickjacking Works

An attacker builds a page with an enticing button, then loads your site in an invisible frame on top of it. The visitor thinks they are clicking the attacker's button but actually clicks "Delete account" or "Transfer" on your site, where they are logged in. Blocking framing stops this.

How to Set It

# Nginx
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Content-Security-Policy "frame-ancestors 'self'" always;

# Apache
Header always set X-Frame-Options "SAMEORIGIN"

Sending both covers older browsers (X-Frame-Options) and modern ones (frame-ancestors).

Which Value to Choose

Situation	Setting
Your pages are never framed	`DENY` / `frame-ancestors 'none'`
Your own site frames its pages	`SAMEORIGIN` / `frame-ancestors 'self'`
Partners must embed your widget	`frame-ancestors 'self' https://partner.example`

The old ALLOW-FROM value is not supported by modern browsers - use frame-ancestors instead. Check the rest of your headers with the Security Headers Checker.

Frequently Asked Questions

Clickjacking tricks a visitor into clicking something on your site while it's invisibly loaded inside an attacker's page (in an iframe) - X-Frame-Options tells browsers whether your page is allowed to be embedded in a frame at all, blocking this technique.

DENY blocks your page from being framed anywhere, including your own other pages; SAMEORIGIN allows framing only by pages on your own domain - most sites that don't intentionally use iframes of their own content choose DENY.

It's being gradually superseded by CSP's frame-ancestors directive, which offers more granular control (allowing specific trusted domains rather than just same-origin-or-nothing) - but X-Frame-Options remains widely supported and still valuable, especially for older browsers.

Yes - the point is preventing OTHER, malicious sites from framing your content without your permission, not restricting your own intentional use of frames.

Yes - if you intentionally want your content embeddable elsewhere (a shareable widget, for example), a blanket DENY or SAMEORIGIN would break that use case; CSP's frame-ancestors offers the granular allowlisting needed for that scenario instead.

The browser simply refuses to render your page inside the malicious frame at all - the attacking page shows a blank space instead, and the visitor never sees your framed content to be tricked by it.