Stopping clickjacking: Crawl Audit check 147

Short answer: clickjacking loads your page invisibly inside another site, so visitors click your buttons without knowing it. The X-Frame-Options header, or the frame-ancestors part of a Content-Security-Policy, tells browsers who may put your page in a frame. Check 147 fails if you send neither.

What Crawl Audit checks

• Pass: an X-Frame-Options header, or a Content-Security-Policy that includes frame-ancestors.
• Fail: neither.

What the sources say

• MDN on DENY: "The document cannot be loaded in any frame, regardless of origin". On SAMEORIGIN: "The document can only be embedded if all ancestor frames have the same origin as the page itself."
• MDN: ALLOW-FROM "is an obsolete directive". Browsers that see it ignore the whole header.
• OWASP: the CSP "frame-ancestors directive obsoletes X-Frame-Options for supporting browsers". Its clickjacking guide still suggests using more than one defence where you can.

Which value to use

• Nobody frames your pages: DENY, or frame-ancestors 'none'.
• Only your own site does: SAMEORIGIN, or frame-ancestors 'self'.
• A named partner does: use frame-ancestors and list them. X-Frame-Options can't name other sites.

X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self'

A subdomain is a different origin. If shop.example.com frames a page from example.com, SAMEORIGIN blocks it, so list the subdomain in frame-ancestors instead.

On devmarde.com

Until 6 October we sent neither header and this check failed for us. That day we added X-Frame-Options: SAMEORIGIN to every page, after confirming that nothing of ours frames our pages. It passes now.

Sources

• MDN, X-Frame-Options (updated 17 September 2026).
• OWASP, HTTP Headers Cheat Sheet and Clickjacking Defense Cheat Sheet, checked 6 October 2026.