Fix the X-Frame-Options value on Apache

headers.clickjacking.xfo_invalid · effort: minutes

Why it matters

Browsers only honour a single DENY or SAMEORIGIN. ALLOW-FROM or another unknown value is ignored and leaves the page frameable, while conflicting values block all framing, even by your own pages.

The fix

Remove the copy in the default table and set one value in the always table, as the mod_headers documentation recommends for headers a backend may also set. Reload Apache.

apache

Header onsuccess unset X-Frame-Options
Header always set X-Frame-Options "SAMEORIGIN"

Read the documentation (opens in a new tab)

Reported by the Clickjacking protection check
Stop other sites from framing your pages
Limit frame-ancestors to sites you trust

Scan your domain to see whether this applies to you.

Why it matters

The fix

Related