DevUtilsNow
Browse tools
// http header · security header

X-Frame-Options

Control framing to prevent clickjacking

What the X-Frame-Options header does

X-Frame-Options controls whether your page may be embedded in a frame — DENY blocks all framing, SAMEORIGIN allows only your own site. It defends against clickjacking, where an attacker frames your page invisibly. Modern policies increasingly use CSP's frame-ancestors instead.

Example

X-Frame-Options: DENY

Where it's used

X-Frame-Options is a security header. Security headers tell the browser to turn on protections against common web attacks.

Other security headers

Strict-Transport-Security Content-Security-Policy X-Content-Type-Options X-Frame-Options Referrer-Policy Permissions-Policy
TOOL

HTTP Headers Parser

Turn a block of raw headers into readable JSON.

REFERENCE

All HTTP Headers

Common request, response, caching, CORS, and security headers.

GUIDE

How to Read and Parse HTTP Headers

The anatomy of headers and how to work with them.