X-Frame-Options

May this page be put in an iframe? DENY stops clickjacking; superseded by CSP frame-ancestors but still widely sent.

response header

Example

X-Frame-Options: DENY

What it does: May this page be put in an iframe? DENY stops clickjacking; superseded by CSP frame-ancestors but still widely sent.

Works with