This guide explains how to use the HTTP header X-Frame-Options to limit the display of your pages in frames (<frame> and <iframe>) and help protect against clickjacking attacks.

X-Frame-Options Header Values

The HTTP X-Frame-Options header indicates to the browser whether a page can be displayed within a <frame> or <iframe> tag.

• DENY: completely prohibits displaying the page in a frame, including from your own site.
• SAMEORIGIN: allows display only when the page is embedded from the same domain.

Setting up the header

To apply this protection to your entire site, add the following directive to the .htaccess file:

Header set X-Frame-Options "SAMEORIGIN"

You can also send this header from a PHP script:

Allow a specific domain with Content-Security-Policy

Autoriser un domaine spécifique avec Content-Security-Policy

To allow an external domain to embed your content in an iframe, use the Content-Security-Policy header with the frame-ancestors directive.

Example:

Header set Content-Security-Policy "frame-ancestors 'self' https://domain.xyz"

This rule allows your own site ('self') as well as https://domain.xyz to embed your pages in an iframe.