webzod
account

Fix the X-Frame-Options value on nginx

headers.clickjacking.xfo_invalid · effort: minutes

Why it matters

Browsers only honour a single DENY or SAMEORIGIN. ALLOW-FROM or another unknown value is ignored and leaves the page frameable, while conflicting values block all framing, even by your own pages.

The fix

  1. Hide the application's copy and set one value as below, run sudo nginx -t and reload. Use fastcgi_hide_header instead of proxy_hide_header for PHP-FPM.
nginx 
proxy_hide_header X-Frame-Options;
add_header X-Frame-Options "SAMEORIGIN" always;

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.