X-Frame-Options
Controls whether the page can be embedded in iframes. Prevents clickjacking.
ResponseSyntax
X-Frame-Options: DENY | SAMEORIGIN | ALLOW-FROM <uri>Example values
| Value | Explanation |
|---|---|
| DENY | No framing |
| SAMEORIGIN | Same origin only |
cURL usage
curl -I https://example.com # Check framing policy
Common mistakes
ALLOW-FROM deprecated; use CSP frame-ancestors instead.