et the **legacy** X-Frame-Options
](https://helmetjs.github.io/#x-frame-options) header on old browsers.

**Warning:** It's recommended to use the [ ` Content-Security-Policy ` ](/en-
US/docs/Web/HTTP/Headers/Content-Security-Policy) HTTP header with the [ `
frame-ancestors ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-
Policy/frame-ancestors) directive instead.

To use Helmet to set ` X-Frame-Options ` , add the following to your server
configuration to set the ` SAMEORIGIN ` directive:

js

    
    
    const helmet = require("helmet");
    const app = express();
    app.use(
      helmet({
        xFrameOptions: { action: "sameorigin" },
      }),
    );
    

##  Specifications

Specification  
---  
[ HTML Standard  
#  the-x-frame-options-header
](https://html.spec.whatwg.org/multipage/document-lifecycle.html#the-x-frame-
options-header)  
  
##  Browser compatibility

BCD tables only load in the browser  with JavaScript enabled. Enable
JavaScript to view data.

##  See also

  * [ ` Content-Security-Policy ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy) directive [ ` frame-ancestors ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors)
  * [ ClickJacking Defenses - IEBlog ](https://docs.microsoft.com/archive/blogs/ie/ie8-security-part-vii-clickjacking-defenses)
  * [ Combating ClickJacking with X-Frame-Options - IEInternals ](https://docs.microsoft.com/archive/blogs/ieinternals/combating-clickjacking-with-x-frame-options)

##  Help improve MDN

Was this page helpful to you?

Yes  No

[ Learn how to contribute
](https://github.com/mdn/content/blob/main/CONTRIBUTING.md "This will take you
to our contribution guidelines on GitHub.") .

This page was last modified on  Dec 12, 2023  by  [ MDN contributors ](/en-
US/docs/Web/HTTP/Headers/X-Frame-Options/contributors.txt) .

[ View this page on GitHub
](https://github.com/mdn/content/blob/main/files/en-
us/web/http/headers/x-frame-options/index.md?plain=1 "Folder: en-
us/web/http/headers/x-frame-options \(Opens in a new tab\)") â¢  [ Report a
problem with this content
](https://github.com/mdn/content/issues/new?template=page-report.yml&mdn-
url=https%3A%2F%2Fdeveloper.mozilla.org%2Fen-
US%2Fdocs%2FWeb%2FHTTP%2FHeaders%2FX-Frame-
Options&metadata=%3C%21--+Do+not+make+changes+below+this+line+--%3E%0A%3Cdetails%3E%0A%3Csummary%3EPage+report+details%3C%2Fsummary%3E%0A%0A*+Folder%3A+%60en-
us%2Fweb%2Fhttp%2Fheaders%2Fx-frame-
options%60%0A*+MDN+URL%3A+https%3A%2F%2Fdeveloper.mozilla.org%2Fen-
US%2Fdocs%2FWeb%2FHTTP%2FHeaders%2FX-Frame-
Options%0A*+GitHub+URL%3A+https%3A%2F%2Fgithub.com%2Fmdn%2Fcontent%2Fblob%2Fmain%2Ffiles%2Fen-
us%2Fweb%2Fhttp%2Fheaders%2Fx-frame-
options%2Findex.md%0A*+Last+commit%3A+https%3A%2F%2Fgithub.com%2Fmdn%2Fcontent%2Fcommit%2F6e0504e4a750ac4f495086c7aec3bfd293ad6417%0A*+Document+last+modified%3A+2023-12-12T15%3A37%3A50.000Z%0A%0A%3C%2Fdetails%3E
"This will take you to GitHub to file a new issue.")

[ MDN logo  ](/)

Your blueprint for a better internet.

  * [ MDN on Mastodon  ](https://mozilla.social/@mdn)
  * [ MDN on X (formerly Twitter)  ](https://twitter.com/mozdevnet)
  * [ MDN on GitHub  ](https://github.com/mdn/)
  * [ MDN Blog RSS Feed  ](/en-US/blog/rss.xml)

##  MDN

  * [ About ](/en-US/about)
  * [ Blog ](/en-US/blog/)
  * [ Careers ](https://www.mozilla.org/en-US/careers/listings/?team=ProdOps)
  * [ Advertise with us ](/en-US/advertising)

##  Support

  * [ Product help ](https://support.mozilla.org/products/mdn-plus)
  * [ Report an issue ](/en-US/docs/MDN/Community/Issues)

##  Our communities

  * [ MDN Community ](/en-US/community)
  * [ MDN Forum ](https://discourse.mozilla.org/c/mdn/236)
  * [ MDN Chat ](/discord)

##  Developers

  * [ Web Technologies ](/en-US/docs/Web)
  * [ Learn Web Development ](/en-US/docs/Learn)
  * [ MDN Plus ](/en-US/plus)
  * [ Hacks Blog ](https://hacks.mozilla.org/)

[ Mozilla logo  ](https://www.mozilla.org/)

  * [ Website Privacy Notice ](https://www.mozilla.org/pr