What is X-Frame-Options? Clickjacking header + free X-Frame-Options checker
X-Frame-Options is a response header that tells browsers whether your pages may appear inside someone else’s frame. Without it—and without CSP frame-ancestors—a hostile site can overlay a fake UI on your real page (classic clickjacking). A free X-Frame-Options checker (CrowWake’s security headers pulse) confirms framing protection is still live after CDN or origin changes.
What is X-Frame-Options?
X-Frame-Options is an HTTP response header that controls whether a browser may render your page inside a frame or iframe. People search “what is X-Frame-Options,” “X-Frame-Options header,” or “clickjacking” when a security scan, CDN checklist, or auditor asks for framing protection. It is not a DNS record and not a certificate—it is a header on the HTTPS response (or a CSP frame-ancestors directive that does the same job).
What clickjacking looks like without the header
When neither X-Frame-Options nor CSP frame-ancestors is present, any site can embed you. An attacker can place your real login or “Approve” UI under a transparent layer and trick a user into clicking something they did not mean to. Publishing DENY, SAMEORIGIN, or a tight frame-ancestors list closes that door for supporting browsers.
How to check X-Frame-Options (free X-Frame-Options / security headers checker)
1) Run the free security headers checker on the hostname users hit (apex and www if both are live). 2) Confirm X-Frame-Options is present—or CSP lists frame-ancestors—and note the value. 3) Decide DENY (most marketing sites and dashboards) vs SAMEORIGIN vs an explicit frame-ancestors allow-list. 4) After CDN, theme, or “simplify headers” deploys, re-check—framing wipes are common when someone trims header presets. 5) Pair with HSTS / nosniff / HTTPS redirect on the same checker so one pulse covers the security-header baseline.
What CrowWake checks
On HTTPS we look for X-Frame-Options or a Content-Security-Policy frame-ancestors directive. Either present → ok (we summarize the value). Neither → warn. The free security headers checker uses the same signal with no login. CrowWake is not a full clickjack pen-test—this is the public framing pulse. For the repeat “watch headers hourly” job, see the dedicated security headers monitoring guide.
X-Frame-Options vs security headers monitoring
This guide is the definition and publish/triage job: what X-Frame-Options is, how DENY / SAMEORIGIN / frame-ancestors work, and how to check with a free X-Frame-Options / security headers checker. Security headers monitoring is the hourly rooster—catch a silent framing wipe alongside HSTS, nosniff, and HTTPS redirect. Both use the same free checker; CrowWake just repeats the pulse.
DENY, SAMEORIGIN, and CSP frame-ancestors
DENY means never allow framing—the strict default for most sites that never need to be embedded. SAMEORIGIN means only your own origin may frame the page (fine when your app legitimately iframes itself). ALLOW-FROM is obsolete and ignored by modern browsers—do not rely on it. Prefer CSP frame-ancestors when you need an allow-list of partner origins; modern browsers treat frame-ancestors as the successor, and you can publish both while migrating.
When framing is intentional
Payment widgets, help desks, and partner portals sometimes must load inside a parent frame. Set CSP frame-ancestors to the exact parent origins you trust—not a blank policy and not “allow everyone.” If a CDN strips security headers on one hostname but not another, apex and www can disagree; check the hostname users actually hit with the free X-Frame-Options / security headers checker.
Publish checklist
1) Run the free security headers checker and note clickjacking / X-Frame-Options status. 2) Decide DENY (most sites) vs SAMEORIGIN vs an explicit frame-ancestors list. 3) Add the header at the CDN or origin (example: X-Frame-Options: DENY) or set CSP frame-ancestors. 4) Re-check the live response with the free X-Frame-Options / security headers checker. 5) Add the domain so CrowWake crows if framing protection disappears after a rebuild.
If CrowWake crows
Missing framing protection → publish X-Frame-Options or CSP frame-ancestors. Present then gone → restore at the CDN/origin (common after theme or “minify headers” changes). Legitimate embed broken after DENY → switch to SAMEORIGIN or a tight frame-ancestors allow-list for the parent you need. After a fix, re-run the free security headers checker and keep watching.
Watch this on CrowWake
Add the domain, leave the boxes checked, and the flock will crow when this drifts.
Or try the free X-Frame-Options / clickjacking / security headers checker with no login.
Deep dive: Security headers monitoring — watch X-Frame-Options / clickjacking with HSTS, nosniff, and HTTPS redirect on the same free X-Frame-Options / security headers checker.
Related: HSTS guide, HTTPS redirect, X-Content-Type-Options / nosniff, the security headers & open ports guide, and the free security headers checker (same free checker covers all four).