X-Frame-Options / frame-ancestors check

Confirms clickjacking protection is enabled via X-Frame-Options or the modern CSP frame-ancestors directive.

Quick answer

Lemwatch passes the check if the response sets X-Frame-Options: DENY|SAMEORIGIN OR a CSP with frame-ancestors.

What it checks

• X-Frame-Options presence and value
• CSP frame-ancestors directive (preferred)
• Consistency across HTTPS routes

Where to find it in Lemwatch

Site details → Security → Headers.

How to fix

1. Add X-Frame-Options: SAMEORIGIN at your web server.
2. Or better, add frame-ancestors 'self' to your CSP and drop X-Frame-Options.
3. Test any legitimate iframes still load.

FAQ

Which is better, XFO or frame-ancestors?

frame-ancestors — it supports multiple origins and modern browsers ignore XFO when both are set.

Does this protect against all clickjacking?

It covers iframe overlay attacks. UI-redress via popups needs additional mitigations.

Related

• Security headers
• CSP header check
• Cookie security check