How to add the X-Frame-Options header (clickjacking protection)
Without X-Frame-Options, a malicious site can show yours inside an invisible frame and trick visitors into clicking buttons. SAMEORIGIN allows framing only by your own site.
If another site of yours or a partner embeds this site in an iframe, that embed will be blocked. Use CSP frame-ancestors with the allowed sites instead.
How to fix it, by platform
WordPress
Where: your theme's functions.php (or a snippets plugin)
add_action('send_headers', function () {
header("X-Frame-Options: SAMEORIGIN");
});WordPress sends the X-Frame-Options header on every page load.
How to confirm: Reload the site and check the response headers include `X-Frame-Options`.
Cloudflare
Where: Cloudflare dashboard → Rules → Transform Rules → Modify Response Header → Add
Set static — Header name: X-Frame-Options — Value: SAMEORIGIN
Cloudflare injects the X-Frame-Options header at the edge, no server change needed.
How to confirm: Reload the site and check the response headers include `X-Frame-Options`.
Vercel / Next.js
Where: next.config.js → async headers()
module.exports = {
async headers() {
return [{ source: "/(.*)", headers: [
{ key: "X-Frame-Options", value: "SAMEORIGIN" },
]}];
},
};Next.js sets the X-Frame-Options header on every route.
How to confirm: Reload the site and check the response headers include `X-Frame-Options`.
Netlify
Where: a `_headers` file in your publish directory (or netlify.toml)
/* X-Frame-Options: SAMEORIGIN
Netlify applies the X-Frame-Options header to all paths (`/*`).
How to confirm: Reload the site and check the response headers include `X-Frame-Options`.
Nginx
Where: nginx.conf — inside your `server { }` block, then reload nginx
add_header X-Frame-Options "SAMEORIGIN" always;
Adds the X-Frame-Options header for every response.
How to confirm: Reload the site and check the response headers include `X-Frame-Options`.
Apache
Where: .htaccess (or the vhost config), then restart Apache
Header always set X-Frame-Options "SAMEORIGIN"
Adds the X-Frame-Options header via mod_headers.
How to confirm: Reload the site and check the response headers include `X-Frame-Options`.
IIS
Where: web.config — inside <system.webServer><httpProtocol><customHeaders>
<add name="X-Frame-Options" value="SAMEORIGIN" />
Adds the X-Frame-Options header in IIS.
How to confirm: Reload the site and check the response headers include `X-Frame-Options`.
Your web server
Where: your web server's response-header configuration
X-Frame-Options: SAMEORIGIN
Configure your server/CDN to send this header on all responses.
How to confirm: Reload the site and check the response headers include `X-Frame-Options`.
Not sure your site needs this fix? A scan checks this and dozens of other things and shows what yours is missing.
Scan your site free