Check · Security header
No clickjacking protection
What it means
Your app can be embedded in a hidden iframe on someone else's page (no X-Frame-Options / frame-ancestors).
Why it matters
An attacker overlays your real buttons with fake UI and tricks users into clicks they can't see — including destructive ones.
How to fix it
Send X-Frame-Options: SAMEORIGIN or a frame-ancestors CSP directive.
Does your app have this problem? The free passive check tests this and 4 more areas — no login, nothing touched.
Check your app free