What is X-Frame-Options? Stop clickjacking in plain English
X-Frame-Options is a response header that tells browsers whether your pages may appear inside someone else’s frame. Without it, a hostile site can overlay a fake UI on top of your real page—classic clickjacking.
What X-Frame-Options does
When a browser loads your page, it looks for X-Frame-Options. DENY means never allow framing. SAMEORIGIN means only your own origin may frame the page. ALLOW-FROM is obsolete and ignored by modern browsers. If the header is missing and CSP does not set frame-ancestors either, any site can embed you—which is what attackers use for clickjacking.
What CrowWake checks
On HTTPS we look for X-Frame-Options or a Content-Security-Policy frame-ancestors directive. Either present → ok (we summarize the value). Neither → warn. The free security headers checker uses the same signal with no login; CrowWake’s hourly flock watches it afterward so a “cleanup headers” deploy does not silently reopen framing.
DENY, SAMEORIGIN, and CSP frame-ancestors
DENY is the strict default for most marketing sites and dashboards that never need to be framed. SAMEORIGIN is fine when your own app legitimately iframes itself. Prefer CSP frame-ancestors when you need an allow-list of partner origins—modern browsers treat frame-ancestors as the successor; you can publish both while migrating. Do not rely on ALLOW-FROM.
When framing is intentional
Payment widgets, help desks, and partner portals sometimes must load inside a parent frame. In those cases set CSP frame-ancestors to the exact parent origins you trust—not a blank policy. If a CDN strips security headers on one hostname but not another, apex and www can disagree; check the hostname users actually hit.
Quick publish triage
1) Run the free security headers checker and note clickjacking / X-Frame-Options status. 2) Decide DENY (most sites) vs SAMEORIGIN vs an explicit frame-ancestors list. 3) Add the header at the CDN or origin (example: X-Frame-Options: DENY). 4) Re-check the live response. 5) Add the domain so CrowWake crows if framing protection disappears after a rebuild.
If CrowWake crows
Missing framing protection → publish X-Frame-Options or CSP frame-ancestors. Present then gone → restore at the CDN/origin (common after theme or “minify headers” changes). Legitimate embed broken after DENY → switch to SAMEORIGIN or a tight frame-ancestors allow-list for the parent you need. After a fix, re-run the free security headers checker and keep watching.
Watch this on CrowWake
Add the domain, leave the boxes checked, and the flock will crow when this drifts.
Or try the free security headers checker with no login.
Related: security headers monitoring, HSTS guide, HTTPS redirect, X-Content-Type-Options, and the security headers & open ports guide (same free checker covers all four).