X-Frame-Options tells browsers whether your pages are allowed to be loaded inside an <iframe> on someone else's site — without it, an attacker can embed your real login page invisibly inside their own page and trick users into clicking things they don't intend to (clickjacking).
Without this header, attackers can embed your site in a hidden iframe and trick users into clicking invisible buttons — credential theft and unwanted actions (clickjacking).
The X-Frame-Options header directly prevents a specific, genuine attack called clickjacking, where a malicious site embeds your page within an invisible or disguised frame, then tricks visitors into clicking on what appears to be the malicious site's content but is actually your page's functional elements — potentially triggering unintended actions like changing account settings or authorizing transactions.
Without this header, any site on the internet can embed your pages within their own frames, creating the technical precondition this attack depends on — the header explicitly instructs browsers to refuse this framing, closing off the attack vector entirely for any browser that respects the header, which represents the substantial majority of current browsers.
The specific configuration value matters for legitimate use cases — a strict "deny" setting blocks all framing, including any potentially legitimate need your own site might have to frame its own content, while "sameorigin" permits framing only from your own domain, accommodating legitimate same-site framing needs while still blocking the cross-site framing this header specifically protects against.
This represents a genuinely low-effort, high-value security header — implementation typically requires only a single server configuration line, while the protection it provides against a real, documented attack pattern makes this one of the more straightforward wins available within a broader security hardening effort.
The response header X-Frame-Options: SAMEORIGIN (or DENY) is present on your pages.
Fix it, then re-scan — the check confirms itself. No manual checkbox, the scan is the truth.
Run this check in H.I.V.E. →