Revision 1084139 of X-Frame-Options

<div>{{HTTPSidebar}}</div>

<p>The <code>X-Frame-Options</code> <a href="/en-US/docs/Web/HTTP">HTTP</a> response header can be used to indicate whether or not a browser should be allowed to render a page in a {{HTMLElement("frame")}}, {{HTMLElement("iframe")}} or {{HTMLElement("object")}}&nbsp;. Sites can use this to avoid {{interwiki("wikipedia", "clickjacking")}} attacks, by ensuring that their content is not embedded into other sites.</p>

<table class="properties">
 <tbody>
  <tr>
   <th scope="row">Header type</th>
   <td>{{Glossary("Response header")}}</td>
  </tr>
  <tr>
   <th scope="row">{{Glossary("Forbidden header name")}}</th>
   <td>no</td>
  </tr>
 </tbody>
</table>

<h2 id="Syntax">Syntax</h2>

<p>There are three possible directives for <code>X-Frame-Options</code>:</p>

<pre class="syntaxbox">
X-Frame-Options: DENY
X-Frame-Options: SAMEORIGIN
X-Frame-Options: ALLOW-FROM https://example.com/
</pre>

<h3 id="Directives">Directives</h3>

<p>If you specify <code>DENY</code>, not only will attempts to load the page in a frame fail when loaded from other sites, attempts to do so will fail when loaded from the same site. On the other hand, if you specify <code>SAMEORIGIN</code>, you can still use the page in a frame as long as the site including it in a frame is the same as the one serving the page.</p>

<dl>
 <dt><code>DENY</code></dt>
 <dd>The page cannot be displayed in a frame, regardless of the site attempting to do so.</dd>
 <dt><code>SAMEORIGIN</code></dt>
 <dd>The page can only be displayed in a frame on the same origin as the page itself.</dd>
 <dt><code>ALLOW-FROM <em>uri</em></code></dt>
 <dd>The page can only be displayed in a frame on the specified origin.</dd>
</dl>

<h2 id="Examples">Examples</h2>

<div class="note">
<p><strong>Note:</strong>&nbsp;Setting the meta tag is useless! For instance,&nbsp;<code>&lt;meta http-equiv="X-Frame-Options" content="deny"&gt;</code> has no effect. Do not use it! Only by setting through&nbsp;the HTTP header like the examples below, <code>X-Frame-Options</code> will work.</p>
</div>

<h3 id="Configuring_Apache">Configuring Apache</h3>

<p>To configure Apache to send the <code>X-Frame-Options</code> header for all pages, add this to your site's configuration:</p>

<pre>
Header always append X-Frame-Options SAMEORIGIN
</pre>

<h3 id="Configuring_nginx">Configuring nginx</h3>

<p>To configure nginx to send the <code>X-Frame-Options</code> header, add this either to your http, server or location configuration:</p>

<pre>
add_header X-Frame-Options SAMEORIGIN;
</pre>

<h3 id="Configuring_IIS">Configuring IIS</h3>

<p>To configure IIS to send the <code>X-Frame-Options</code> header, add this your site's <code>Web.config</code> file:</p>

<pre class="brush: xml">
&lt;system.webServer&gt;
  ...

  &lt;httpProtocol&gt;
    &lt;customHeaders&gt;
      &lt;add name="X-Frame-Options" value="SAMEORIGIN" /&gt;
    &lt;/customHeaders&gt;
  &lt;/httpProtocol&gt;

  ...
&lt;/system.webServer&gt;
</pre>

<h3 id="Configuring_HAProxy">Configuring HAProxy</h3>

<p>To configure HAProxy to send the <code>X-Frame-Options</code> header, add this to your front-end, listen, or backend configuration:</p>

<pre>
rspadd X-Frame-Options:\ SAMEORIGIN</pre>

<h2 id="Specifications">Specifications</h2>

<table class="standard-table">
 <tbody>
  <tr>
   <th scope="col">Specification</th>
   <th scope="col">Title</th>
  </tr>
  <tr>
   <td>{{RFC("7034")}}</td>
   <td>HTTP Header Field X-Frame-Options</td>
  </tr>
 </tbody>
</table>

<h2 id="Browser_compatibility">Browser compatibility</h2>

<p class="hidden">To contribute to this compatibility data, please write a pull request against this file: <a href="https://github.com/mdn/browser-compat-data/blob/master/http/headers.json">https://github.com/mdn/browser-compat-data/blob/master/http/headers.json</a>.</p>

<p>{{Compat}}</p>

<h2 id="See_also">See also</h2>

<ul>
 <li><a class="external" href="https://blogs.msdn.com/b/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx">ClickJacking Defenses - IEBlog</a></li>
 <li><a href="https://blogs.msdn.com/b/ieinternals/archive/2010/03/30/combating-clickjacking-with-x-frame-options.aspx">Combating ClickJacking with X-Frame-Options - IEInternals</a></li>
 <li><a href="https://tools.ietf.org/html/rfc7034">HTTP Header Field X-Frame-Options - RFC 7034</a></li>
 <li><a href="https://w3c.github.io/webappsec/specs/content-security-policy/#directive-frame-ancestors">CSP Level 2 frame-ancestors directive</a></li>
</ul>