Limit frame-ancestors to sites you trust on Cloudflare

Why it matters

frame-ancestors with * or a bare scheme lets any website frame your pages, which is exactly what clickjacking needs. List only your own origin and the partners that really embed you.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Stage 1: add a Response Header Transform Rule with Add static, header Content-Security-Policy-Report-Only, value frame-ancestors 'self' plus your partners and a report-uri (or report-to) endpoint, as in the generic snippet; without one, nothing is reported.
2. Stage 2: change frame-ancestors in wherever the enforced policy is set (the rule or the origin) and delete the report-only rule.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Clickjacking protection check
• Stop other sites from framing your pages
• Fix the X-Frame-Options value