X-Frame-Options Header Missing or Invalid: How to Fix It

What the X-Frame-Options header is

X-Frame-Options is an HTTP response header that tells the browser whether your page is allowed to be rendered inside a <frame>, <iframe>, <embed> or <object>. When the header is missing or contains an invalid value, the browser applies no restriction, so any third party can load your page inside their own frame. Crawlers such as Screaming Frog and Sitebulb flag this as a security-header issue because the protection it provides is simple to add and widely expected on production sites.

The header accepts only two valid values today: DENY and SAMEORIGIN. Anything else, including a blank value or the long-obsolete ALLOW-FROM syntax, counts as invalid and leaves the page unprotected.

The clickjacking risk

Clickjacking is an attack where a malicious site loads your page inside an invisible or disguised iframe, layers its own content on top, and tricks a user into clicking something they cannot see. The user believes they are interacting with the attacker's page, but their clicks land on your framed page, potentially confirming a payment, changing a setting, or approving a permission. OWASP describes this as a UI redress attack, and a properly set X-Frame-Options header (or its CSP equivalent) is the standard defence because it stops the browser from rendering your page in the attacker's frame in the first place.

Why it matters for SEO

X-Frame-Options is not a direct Google ranking factor, but it still belongs in a technical-SEO audit for three reasons. First, automated SEO crawlers report it, so leaving it unset keeps a visible warning in your reports and clutters your issue backlog. Second, security headers are part of the broader trust and site-quality signals that experienced auditors expect on a healthy domain. Third, and most concretely, a successful clickjacking attack can damage your brand and your users' trust, which has real downstream effects on the engagement and reputation signals that do influence search performance. Fixing it is fast, low-risk, and removes noise from every future crawl.

DENY versus SAMEORIGIN

The two valid values differ in how strict they are:

DENY

The page cannot be loaded in a frame by anyone, including your own domain. Choose this when no part of your own site ever needs to embed the page. It is the most restrictive and safest default for pages such as login screens and account settings.

SAMEORIGIN

The page can be framed only when every ancestor frame shares the same origin as the page itself. This is the common choice for ordinary websites, because some themes, builders, and preview tools legitimately frame your own pages from your own domain. If you are unsure which to pick, SAMEORIGIN is the safe, compatible default.

Relationship to CSP frame-ancestors

X-Frame-Options has been obsoleted in favour of the frame-ancestors directive from the Content-Security-Policy Level 2 specification. frame-ancestors does everything X-Frame-Options does and more: it lets you whitelist several specific domains, supports wildcards, and is the approach OWASP now recommends. Crucially, when a browser supports frame-ancestors and both headers are present, frame-ancestors wins and X-Frame-Options is ignored. The practical takeaway is to set both: frame-ancestors as the modern primary control, and X-Frame-Options as a fallback for any older browser that does not understand CSP framing rules.

How to diagnose it

Check the response headers for any page. From the command line, request only the headers and look for the X-Frame-Options line:

curl -sI https://yourdomain.com/ | grep -i x-frame-options

# Expected output:
# x-frame-options: SAMEORIGIN

If the line is absent, the header is missing. If it shows ALLOW-FROM or an empty value, it is invalid. You can also open your browser DevTools, go to the Network tab, click the document request, and read the Response Headers panel.

How to fix it

Apache

Add this to your .htaccess file or virtual host. The mod_headers module must be enabled.

<IfModule mod_headers.c>
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Content-Security-Policy "frame-ancestors 'self'"
</IfModule>

Nginx

Add this inside the relevant server or location block, then reload Nginx.

add_header X-Frame-Options "SAMEORIGIN" always;
add_header Content-Security-Policy "frame-ancestors 'self'" always;

WordPress

If you cannot edit server config, add the header in PHP via your theme's functions.php or a small plugin.

add_action( 'send_headers', function () {
    header( 'X-Frame-Options: SAMEORIGIN' );
    header( "Content-Security-Policy: frame-ancestors 'self'" );
} );

Many security plugins can also set these headers from a settings page if you prefer not to touch code.

Common mistakes

The most frequent error is still using ALLOW-FROM. This directive is obsolete: modern browsers, including Chrome, Firefox (since version 70), and Safari, do not recognise it and will ignore the entire header, leaving your page with no protection at all. If you need to allow framing from a specific external domain, use CSP frame-ancestors with that domain instead. Other common pitfalls include typos such as SAME-ORIGIN with a hyphen (invalid), setting the header twice with conflicting values, and forgetting the always keyword in Nginx or Apache so the header is dropped on error responses.

FAQ