Fix guide · Web application · low

X-Frame-Options missing (clickjacking)

Without X-Frame-Options, any website can load your pages inside an invisible frame and trick visitors into clicking buttons they cannot see: approving a payment, changing a setting, or liking something. This is called clickjacking. The header tells browsers not to let other sites frame you.

Time to fix

5 minutes

Risk if ignored

Visitors tricked into hidden clicks

Breaks anything?

Only if another site of yours embeds these pages in a frame

How to fix it

In the server block (or http block for every site):

add_header X-Frame-Options "SAMEORIGIN" always;

Then: sudo nginx -t && sudo systemctl reload nginx

Rules → Transform Rules → Modify Response Header → Set static:

Header name: X-Frame-Options
Value: SAMEORIGIN

Applies to every response through Cloudflare, no server change needed.

WordPress already has a function for this; turn it on for every page in your theme's functions.php (or a small plugin):

add_action('send_headers', 'send_frame_options_header', 10, 0);

It sends X-Frame-Options: SAMEORIGIN, the same as WordPress uses on its login and admin pages.

Also add frame-ancestors 'self' to your Content-Security-Policy. It is the modern replacement; sending both covers old and new browsers.

Check your fix

Common mistakes

Using DENY when your own site frames its pages (for example a preview pane), which breaks them. SAMEORIGIN allows your own site.
Using ALLOW-FROM. Browsers no longer support it; use CSP frame-ancestors to allow specific sites.
Setting it in a <meta> tag. Browsers ignore X-Frame-Options there.