X-Frame-Options
===============

The **`X-Frame-Options`** HTTP response header can be used to indicate whether a browser should be allowed to render a page in a `<frame>`, `<iframe>`, `<embed>` or `<object>`. Sites can use this to avoid click-jacking attacks, by ensuring that their content is not embedded into other sites.

The added security is provided only if the user accessing the document is using a browser that supports `X-Frame-Options`.

**Warning:** The `Content-Security-Policy` HTTP header has a `frame-ancestors` directive which obsoletes this header for supporting browsers.


|  |  |
| --- | --- |
| Header type | Response header |
| Forbidden header name | no |

Syntax
------

There are two possible directives for `X-Frame-Options`:


```http
X-Frame-Options: DENY
X-Frame-Options: SAMEORIGIN
```

### Directives

If you specify `DENY`, not only will the browser attempt to load the page in a frame fail when loaded from other sites, attempts to do so will fail when loaded from the same site. On the other hand, if you specify `SAMEORIGIN`, you can still use the page in a frame as long as the site including it in a frame is the same as the one serving the page.

`DENY`

The page cannot be displayed in a frame, regardless of the site attempting to do so.

`SAMEORIGIN`

The page can only be displayed if all ancestor frames are same origin to the page itself.

`ALLOW-FROM origin` 
Deprecated

This is an obsolete directive. Modern browsers that encounter response headers with this directive will ignore the header completely. The `Content-Security-Policy` HTTP header has a `frame-ancestors` directive which you should use instead.

Examples
--------

**Warning:** Setting `X-Frame-Options` inside the `<meta>` element (e.g., `<meta http-equiv="X-Frame-Options" content="deny">`) has no effect and should not be used! `X-Frame-Options` is only enforced via HTTP headers, as shown in the examples below.

### Configuring Apache

To configure Apache to send the `X-Frame-Options` header for all pages, add this to your site's configuration:


```apacheconf
Header always set X-Frame-Options "SAMEORIGIN"
```


To configure Apache to set `X-Frame-Options` to `DENY`, add this to your site's configuration:


```apacheconf
Header set X-Frame-Options "DENY"
```

### Configuring Nginx

To configure Nginx to send the `X-Frame-Options` header, add this either to your http, server or location configuration:


```nginx
add\_header X-Frame-Options SAMEORIGIN always;
```


You can set the `X-Frame-Options` header to `DENY` using:


```nginx
add\_header X-Frame-Options DENY always;
```

### Configuring IIS

To configure IIS to send the `X-Frame-Options` header, add this to your site's `Web.config` file:


```xml
<system.webServer>
  …
  <httpProtocol>
    <customHeaders>
      <add name="X-Frame-Options" value="SAMEORIGIN" />
    </customHeaders>
  </httpProtocol>
  …
</system.webServer>
```


For more information, see the Microsoft support article on setting this configuration using the IIS Manager user interface.

### Configuring HAProxy

To configure HAProxy to send the `X-Frame-Options` header, add this to your front-end, listen, or backend configuration:
```

rspadd X-Frame-Options:\ SAMEORIGIN
```


Alternatively, in newer versions:
```

http-response set-header X-Frame-Options SAMEORIGIN
```

### Configuring Express

You can use Helmet to configure an Express app to set the **legacy** X-Frame-Options header on old browsers.

**Warning:** It's recommended to use the `Content-Security-Policy` HTTP header with the `frame-ancestors` directive instead.

To use Helmet to set `X-Frame-Options`, add the following to your server configuration to set the `SAMEORIGIN` directive:


```js
const helmet = require("helmet");
const app = express();
app.use(
  helmet({
    xFrameOptions: { action: "sameorigin" },
  }),
);
```

Specifications
--------------

| Specification |
| --- |
| HTML Standard # the-x-frame-options-header |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Content-Security-Policy` directive `frame-ancestors`
* ClickJacking Defenses - IEBlog
* Combating ClickJacking with X-Frame-Options - IEInternals