Stop other sites from framing your pages on Vercel

Why it matters

Without frame-ancestors or X-Frame-Options any site can load your pages in an invisible frame and trick visitors into clicking buttons they cannot see. One header tells browsers which sites, if any, may frame them.

The fix

1. Add the headers below to vercel.json (merge into an existing headers array; if it already sets a Content-Security-Policy, add frame-ancestors 'self' to that value) and redeploy.

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        { "key": "X-Frame-Options", "value": "SAMEORIGIN" },
        { "key": "Content-Security-Policy", "value": "frame-ancestors 'self'" }
      ]
    }
  ]
}

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Clickjacking protection check
• Fix the X-Frame-Options value
• Limit frame-ancestors to sites you trust