Security headers check
The page cannot be framed
X-Frame-Options is set, or the content security policy declares frame-ancestors.
low severitysec.clickjacking
Run this check on your site
Runs just this check in quick mode. The report opens with the evidence and the fix.
Why it matters
A page that can be framed can be covered by a convincing overlay in another site, which is how clickjacking attacks work.
How to fix it
Send X-Frame-Options: DENY, or add frame-ancestors to the content security policy.
The details
- Category
- Security headers
- Severity of a failure
- low
- Confidence
- high
- Needs a browser
- No
- Check id
- sec.clickjacking