What is X-Frame-Options?

X-Frame-Options controls whether a page may be displayed in a <frame>, <iframe>, or similar. Common values are DENY and SAMEORIGIN.

Modern sites often prefer CSP frame-ancestors, which is more expressive. HeaderGrade treats either signal as addressing clickjacking framing risk.

Examples

X-Frame-Options: SAMEORIGIN

Content-Security-Policy: frame-ancestors 'self'

If you intentionally embed your app in partner frames, allow those origins explicitly instead of a blanket deny.

Grade a URL