X-Frame-Options
Controls whether your pages can be embedded in a frame or iframe on another site, the classic defence against clickjacking.
What it does
X-Frame-Options tells the browser whether the current page is allowed to render inside a <frame>, <iframe>, or <object> on another origin. Set it to disallow framing entirely, and browsers will refuse to display your page inside someone else's.
Why it matters
Without this header, an attacker can overlay your page inside an invisible iframe on their own site, positioned precisely under a fake button. A user thinks they're clicking "Play video" on the attacker's page, but they're actually clicking "Delete account" on yours: this is clickjacking.
Recommended value
DENY: never allow framing, from any origin. The right choice for almost all pages, including login and account settings.SAMEORIGIN: allow framing only by pages on your own origin. Use this only if you deliberately embed your own pages in your own iframes.
The modern replacement is the CSP frame-ancestors directive, which supports a full list of allowed origins rather than an all-or-nothing choice. If you already set a strong Content-Security-Policy with frame-ancestors, X-Frame-Options becomes a defence-in-depth fallback for the small number of older browsers that don't support it.