Fix the X-Frame-Options value on Caddy

headers.clickjacking.xfo_invalid · effort: minutes

Why it matters

Browsers only honour a single DENY or SAMEORIGIN. ALLOW-FROM or another unknown value is ignored and leaves the page frameable, while conflicting values block all framing, even by your own pages.

The fix

Set the header with the > prefix so it replaces the application's value after the response comes back, then reload.

Caddyfile

header >X-Frame-Options SAMEORIGIN

Read the documentation (opens in a new tab)

Reported by the Clickjacking protection check
Stop other sites from framing your pages
Limit frame-ancestors to sites you trust

Scan your domain to see whether this applies to you.

Why it matters

The fix

Related