X-Frame-Options
Definition
X-Frame-Options restricts whether a webpage may be embedded within other pages.
An HTTP response header that restricts embedding a page in frames with DENY or SAMEORIGIN.
Simply explained
The website informs the browser whether other pages are allowed to display it in an embedded window.
Why it matters in practice
The term contributes to secure, maintainable, and high-performance web applications as well as resilient technical decisions.
Example from business
An administration portal forbids foreign embedding and adds a suitable CSP.
Limits and pitfalls
- ALLOW-FROM is inconsistent; header only affects browser rendering and does not replace CSRF protection.
Origin & history
RFC 7034 documented in 2013 the widespread header against clickjacking; CSP frame-ancestors is more flexible.
Use in mid-sized companies
- Possible example: An administration portal forbids foreign embedding and adds a suitable CSP.
Frequently asked questions
What does X-Frame-Options mean?
An HTTP response header that restricts embedding a page in frames with DENY or SAMEORIGIN. What should be considered? ALLOW-FROM is inconsistent; header only affects browser rendering and does not replace CSRF protection.
Sources
- IETF RFC 7034 · IETF RFC 7034
Source checked on 10.10.2026. Editorial usage examples are hypothetical; no evidence of real customer results.
Editorially reviewed on: