Missing X-Frame-Options Header

What This Means

The HTTP response does not include an X-Frame-Options header. Without it, any site can embed this page in an iframe.

Why It Matters for SEO

Clickjacking attacks use transparent iframes to overlay a legitimate page over a malicious one — users think they are clicking on the legitimate page but are actually clicking on hidden elements in the attacker's page. X-Frame-Options prevents the page from being embedded in iframes on unauthorized domains.

Note: modern sites can use Content-Security-Policy: frame-ancestors 'self' as a more flexible alternative. Both approaches are valid.

What the Platform Checks

Checks for X-Frame-Options in the response headers. Fires when absent (and no frame-ancestors CSP directive is present).

How to Fix It

• Add X-Frame-Options: DENY to prevent all iframing (most secure), or X-Frame-Options: SAMEORIGIN to allow iframing from your own domain only.
• Alternatively, use CSP: Content-Security-Policy: frame-ancestors 'self'
• Set this header server-wide — in Apache, Nginx, or your CDN configuration.