#xframeoptions

Clickjacking hides your site in an invisible frame to hijack visitor clicks. Learn how it works and the single HTTP header that stops it for good.

X-Frame-Options tells browsers whether your site may be embedded in a frame, and it is the classic defense against clickjacking. Here is how DENY and SAMEORIGIN work, which values silently fail, and when to switch to CSP frame-ancestors.