Free tool
X-Frame-Options Test
If your pages can be loaded inside someone else's iframe, they can be overlaid with fake UI and your logged-in users tricked into clicking things they never see. Two headers prevent that — this tests whether you send either one.
What this checks
- ✓No clickjacking protection Security header
How the check works
We request your page and read the response headers exactly as a browser would. We look for X-Frame-Options (DENY or SAMEORIGIN) and for a Content-Security-Policy containing a frame-ancestors directive. Either one prevents framing; neither means any site can embed you. Passive, read-only, nothing stored.
Common questions
What is clickjacking?
An attacker loads your real page in an invisible iframe on their own site, puts fake buttons on top, and lets a logged-in visitor click. The click lands on your page — delete, confirm, pay — while the victim believes they clicked something else entirely.
X-Frame-Options or CSP frame-ancestors — which should I use?
frame-ancestors is the modern replacement and more expressive: it takes a list of allowed origins. X-Frame-Options is older but still widely honoured. Sending both is fine and is the safest default while older browsers are still around.
DENY or SAMEORIGIN?
DENY blocks all framing, including from your own domain. SAMEORIGIN lets your own pages frame each other. Choose DENY unless you embed your own pages; if third parties must embed you, use frame-ancestors with an explicit allowlist instead.
Where do I set the header?
At the hosting layer, once: a headers entry in vercel.json, a _headers file on Netlify, or your reverse-proxy config. It applies to every response, so there is nothing to add per page.
All free tools · every check explained · run the full 15-point check