---
title: "X-Frame-Options / frame-ancestors check — Lemwatch Help"
description: "Confirms clickjacking protection is enabled via X-Frame-Options or the modern CSP frame-ancestors directive."
canonical: "https://lemwatch.com/help/x-frame-options-check"
source: "https://lemwatch.com"
---

# X-Frame-Options / frame-ancestors check

> Confirms clickjacking protection is enabled via X-Frame-Options or the modern CSP frame-ancestors directive.

## Quick answer

 Lemwatch passes the check if the response sets X-Frame-Options: DENY|SAMEORIGIN OR a CSP with frame-ancestors .

## What it checks

- X-Frame-Options presence and value

- CSP frame-ancestors directive (preferred)

- Consistency across HTTPS routes

## Where to find it in Lemwatch

 **Site details → Security → Headers.**

## How to fix

- Add X-Frame-Options: SAMEORIGIN at your web server.

- Or better, add frame-ancestors 'self' to your CSP and drop X-Frame-Options.

- Test any legitimate iframes still load.

## FAQ

### Which is better, XFO or frame-ancestors?

 frame-ancestors — it supports multiple origins and modern browsers ignore XFO when both are set.

### Does this protect against all clickjacking?

 It covers iframe overlay attacks. UI-redress via popups needs additional mitigations.

## Related

- Security headers

- CSP header check

- Cookie security check


## Related

- [Help centre](https://lemwatch.com/help)
- [Security Headers Explained](https://lemwatch.com/help/security-headers)
- [Content-Security-Policy header check](https://lemwatch.com/help/csp-header-check)
- [Cookie security check](https://lemwatch.com/help/cookie-security-check)
- [TLS version & cipher check](https://lemwatch.com/help/tls-version-check)
- [Lemwatch pricing](https://lemwatch.com/pricing)
- [How do I export all my account data?](https://lemwatch.com/help/account-data-export)
- [How does Lemwatch detect WordPress plugins and themes?](https://lemwatch.com/help/wordpress-fingerprinting)