webzod
account

Limit frame-ancestors to sites you trust

headers.clickjacking.frame_ancestors_wildcard · effort: minutes

Why it matters

frame-ancestors with * or a bare scheme lets any website frame your pages, which is exactly what clickjacking needs. List only your own origin and the partners that really embed you.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. Find out who legitimately frames your pages (partners, your own apps, embedded widgets).
  2. Stage 1: send the narrowed value in Content-Security-Policy-Report-Only with a reporting endpoint (report-to, plus report-uri for older browsers); without one, nothing is reported. Watch for reports from legitimate embedders. Safari does not report frame-ancestors violations, so also ask known embedders to check their pages.
  3. Stage 2: replace the wildcard in the enforced policy.
text 
# Stage 1
Reporting-Endpoints: csp="https://your-collector/csp"
Content-Security-Policy-Report-Only: frame-ancestors 'self' https://partner.example; report-to csp; report-uri https://your-collector/csp
# Stage 2
Content-Security-Policy: frame-ancestors 'self' https://partner.example

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.