X-Frame-Options
An HTTP response header that tells a browser whether the page may be shown inside a frame on another site: DENY forbids it everywhere, SAMEORIGIN only on the same origin. CrawlCheck sends DENY on its own sensitive pages, and its broken-embed check reads the header on every frame source a scanned homepage loads.
What X-Frame-Options does not show
It only matters to browsers that honour it, and a Content-Security-Policy frame-ancestors list overrides it.
Terms this definition uses
Content-Security-Policy · frame-ancestors
Definitions that name X-Frame-Options
Related terms in Security and privacy
Where an agent, a tool or a page can be turned against its operator, and the controls that limit the damage without proving safety.
frame-ancestors · Referrer-Policy · Permissions-Policy · Encrypted Client Hello · lookalike domain · homoglyph · incident switch · high-risk field · Indirect prompt injection · Direct prompt injection · Jailbreak · Data exfiltration · Sensitive information disclosure · Secret leakage · Insecure output handling · Excessive agency · Least privilege · Trust boundary · Input validation · Output validation · Allowlist · Denylist · SSRF · RCE · Credential scope · OAuth scope · API key · Bearer token · mTLS · Rate-limit policy · Audit log · PII · Data minimization · Purpose limitation · Retention period · Data residency · Tenant isolation · Threat model · DMARC · DMARC alignment · SPF · DKIM · MTA-STS · TLS-RPT · CAA record · DNSSEC · hard bounce
Questions about X-Frame-Options
What is X-Frame-Options?
An HTTP response header that tells a browser whether the page may be shown inside a frame on another site: DENY forbids it everywhere, SAMEORIGIN only on the same origin. CrawlCheck sends DENY on its own sensitive pages, and its broken-embed check reads the header on every frame source a scanned homepage loads.
What does X-Frame-Options not show or guarantee?
An HTTP response header that tells a browser whether the page may be shown inside a frame on another site: DENY forbids it everywhere, SAMEORIGIN only on the same origin. It only matters to browsers that honour it, and a Content-Security-Policy frame-ancestors list overrides it.
Which area of the glossary does X-Frame-Options belong to?
Security and privacy: Where an agent, a tool or a page can be turned against its operator, and the controls that limit the damage without proving safety.
See it in the full glossary · 772 terms across 19 areas.
Free browser extension
See this on any site you visit, in one click.
CrawlCheck for Chrome grades every site you visit A–F and shows, from your own browser, what search engines and AI assistants are actually served. Free, no account.