# X-Frame-Options

1.  [Home](https://mysites.guru/)
2.  [Tools](https://mysites.guru/tools/)
3.  [Security headers](https://mysites.guru/tools/security-headers/)
4.  X-Frame-Options

# X-Frame-Options

![X-Frame-Options](https://mysites.guru/_astro/x-frame-options.DiUgZcxp_Z2ledRJ.webp)

X-Frame-Options stops other sites loading your pages in an iframe, which blocks clickjacking. The SAMEORIGIN value and the Apache and nginx lines to add.

## Quick answer

Send X-Frame-Options: SAMEORIGIN so only your own site can load its pages in a frame. On Apache add this to .htaccess; on nginx use add\_header X-Frame-Options "SAMEORIGIN" always;

```apache
Header always set X-Frame-Options "SAMEORIGIN"
```

Article Contents

-   [How the X-Frame-Options check works](#how-the-x-frame-options-check-works)
-   [A click that isn’t going where it looks](#a-click-that-isnt-going-where-it-looks)
-   [The value to set, and the one to avoid](#the-value-to-set-and-the-one-to-avoid)
-   [Adding the X-Frame-Options header](#adding-the-x-frame-options-header)
-   [Why framing rules are left to you](#why-framing-rules-are-left-to-you)
-   [Further Reading](#further-reading)
-   [Frequently Asked Questions](#faq)

How common is this?

-   49% of the Joomla sites we have this data for fail this check. Platform: Joomla.

Measured across the sites we audit, on each site's most recent snapshot.

## How the X-Frame-Options check works

mySites.guru requests a page from your Joomla extension site and inspects the raw HTTP response headers for `X-Frame-Options`, checking both that it’s present and that the value it has is one browsers actually still honour. We check a page your server answers directly, such as a 404, rather than only the homepage, because headers added through a Joomla extension often only fire when PHP handles the request. [Checking your website’s security headers with mySites.guru](https://mysites.guru/blog/check-your-websites-security-headers-with-mysites-guru/) covers this check alongside the other three.

## A click that isn’t going where it looks

Clickjacking is a deceptively simple attack. An attacker builds a page of their own, loads your site into an invisible `<iframe>`, and positions it using ordinary CSS so it sits directly underneath something that looks like a harmless button or link on their page. A visitor sees the attacker’s overlay, believes they’re clicking that, and clicks it. What actually receives the click is your site, hidden underneath, in a frame the visitor never knew was there.

The part that makes this dangerous rather than just annoying is that the browser executes that click in the context of whatever session the visitor already has open. If they’re logged into your Joomla extension admin area in another tab, an attacker can potentially frame an admin action, an account change, a form submission, and trick the visitor into triggering it without ever realising they interacted with your site at all. `X-Frame-Options` exists specifically to stop this, by telling the browser upfront whether your pages are allowed to be framed by anyone else.

The reason this still matters even on an ordinary brochure site, not just a bank or a webmail provider, is that the technique doesn’t need a dramatic target to be worth an attacker’s time. A single “delete my account” button, a newsletter unsubscribe link that also happens to trigger something else, or a contact form that’s really a password-reset confirmation dressed up differently, all become usable once an attacker can frame the page and layer their own content on top. The header is cheap to set and closes off the entire technique in one move, which is why it’s worth setting on every site regardless of how sensitive its content looks.

## The value to set, and the one to avoid

For the great majority of sites, the correct value is:

```text
X-Frame-Options: SAMEORIGIN
```

This blocks any other domain from framing your pages while still allowing your own site to frame its own pages, which some CMS admin previews and iframe-based tools depend on. `DENY` is stricter still and appropriate if literally nothing on the site should ever appear in a frame, including your own. Avoid `ALLOW-FROM`: it lets you name specific domains permitted to frame your site, but no current browser implements it any more, so a header set to that value is providing no real protection while looking like it is.

X-Frame-Options is being superseded, but still worth setting

Modern browsers honour the `frame-ancestors` directive inside a [Content-Security-Policy](https://mysites.guru/tools/security-headers/content-security-policy/) header in preference to X-Frame-Options, and it offers finer control than a single header value allows. Set both where you can: frame-ancestors for browsers that support it, X-Frame-Options as a fallback for the ones that don’t. The same pattern applies elsewhere in this space, where Feature-Policy has been replaced by the newer Permissions-Policy header.

## Adding the X-Frame-Options header

Set the header at server level so it applies to every response, not only the ones a Joomla extension can reach. In an `.htaccess` file, applied against `https://yoursite.com/administrator` and your front end:

```apache
Header always set X-Frame-Options "SAMEORIGIN"
```

On nginx, inside your server block:

```nginx
add_header X-Frame-Options "SAMEORIGIN" always;
```

1.  Decide whether anything on the site legitimately needs to frame itself, such as a preview panel or an embedded admin widget. If nothing does, use `DENY` instead of `SAMEORIGIN`.
2.  Add the header at server or virtual host level rather than through a plugin, so it covers static assets and error pages, not only PHP-rendered ones.
3.  If you’re setting a Content-Security-Policy too, add a matching `frame-ancestors` directive there as well, since it’s the value modern browsers will actually prefer.
4.  Test by trying to frame your own site from an unrelated domain. A quick way to check is to save a small HTML file with `<iframe src="https://yoursite.com"></iframe>` and open it directly in a browser, from a different origin than your own site. It should refuse to load, and the browser console will usually name the header that blocked it.
5.  Check anything that legitimately embeds your content elsewhere, such as an approved partner site, still works, since `SAMEORIGIN` will correctly block it too unless you’ve built that case into a `frame-ancestors` allow-list instead.

## Why framing rules are left to you

Whether your site should ever be framed, and by whom, is a decision only you can make safely, so we don’t apply this automatically. mySites.guru checks for X-Frame-Options on every snapshot, twice a day, and shows you the exact value your site is currently sending, alongside the other response headers we check: [Content-Security-Policy](https://mysites.guru/tools/security-headers/content-security-policy/), [Strict-Transport-Security](https://mysites.guru/tools/security-headers/strict-transport-security/) and [X-Content-Type-Options](https://mysites.guru/tools/security-headers/x-content-type-options/).

## [X-Frame-Options](https://mysites.guru/free-audit/?check=joomla/responsesecurityheadersinformation/xframeoptions)

mySites.guru checks every connected site for this automatically and flags it the moment it appears. These run twice a day on every connected site.

[Check your site for free](https://mysites.guru/free-audit/?check=joomla/responsesecurityheadersinformation/xframeoptions)

## Further Reading

-   [Scott Helme: hardening your HTTP response headers (X-Frame-Options)](https://scotthelme.co.uk/hardening-your-http-response-headers/#x-frame-options)
-   [Troy Hunt: Clickjack attack - the hidden threat right in front of you](https://www.troyhunt.com/2013/05/clickjack-attack-hidden-threat-right-in.html)
-   [MDN: X-Frame-Options header reference](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options)

## Frequently Asked Questions

Show all

What is clickjacking, in plain terms?

An attacker loads your site into an invisible iframe on their own page, then layers convincing-looking buttons or content on top of it using CSS. A visitor thinks they're clicking the attacker's page, but the click actually lands on your site underneath, in the context of whatever session the visitor is already logged into.

Should I use DENY or SAMEORIGIN for X-Frame-Options?

SAMEORIGIN is right for almost every site. It stops any other domain framing your pages while still letting your own site frame itself, which some admin tools and preview features rely on. DENY is only worth using if nothing on the site should ever be loaded in a frame, including by itself.

Is ALLOW-FROM a safe value to use?

No. Every major browser dropped support for ALLOW-FROM years ago, so a header set to that value provides no protection at all, even though it looks like it should. Use SAMEORIGIN, or move the equivalent control into a Content-Security-Policy's frame-ancestors directive.

[![EU icon: AI MODIFIED](https://mysites.guru/_astro/ai-modified.CaoawZEQ_1In0VX.webp)Written and edited by a human, with AI assistance. Our approach to AI](https://mysites.guru/ai-statement/)

### Article Contents

-   [How the X-Frame-Options check works](#how-the-x-frame-options-check-works)
-   [A click that isn’t going where it looks](#a-click-that-isnt-going-where-it-looks)
-   [The value to set, and the one to avoid](#the-value-to-set-and-the-one-to-avoid)
-   [Adding the X-Frame-Options header](#adding-the-x-frame-options-header)
-   [Why framing rules are left to you](#why-framing-rules-are-left-to-you)
-   [Further Reading](#further-reading)
-   [Frequently Asked Questions](#faq)

- **Published** - 28 August 2026
- **Applies to** - Joomla
- **One-click fix** - Manual fix

Share

[](https://x.com/intent/post?url=https%3A%2F%2Fmysites.guru%2Ftools%2Fsecurity-headers%2Fx-frame-options%2F&text=X-Frame-Options)[](https://bsky.app/intent/compose?text=X-Frame-Options%20https%3A%2F%2Fmysites.guru%2Ftools%2Fsecurity-headers%2Fx-frame-options%2F)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fmysites.guru%2Ftools%2Fsecurity-headers%2Fx-frame-options%2F)

Topics

[Security headers](https://mysites.guru/tools/security-headers/)Joomla

[

★★★★★

> "En ce moment mon tool préféré c'est @mysitesguru pour la gestion de site > Installation de plugin en masse > Mise en place de sécurité en un clic > Alerte en cas de modification suspicieuse > Monitoring de site Et ils ont mis un plan site illimité 🔥"

![Maxim 👀](https://mysites.guru/images/reviews/maxim.webp)

Maxim 👀@KayzPool



](https://mysites.guru/reviews/)

## More checks in [Security headers](https://mysites.guru/tools/security-headers/)

-   [
    
    ### Content-Security-Policy
    
    Content-Security-Policy is a response header that tells the browser which sources of scripts and content it may load, closing off most XSS attacks.
    
    ](https://mysites.guru/tools/security-headers/content-security-policy/)
-   [
    
    ### Strict-Transport-Security (HSTS)
    
    Strict-Transport-Security (HSTS) makes browsers use HTTPS only for your site. The max-age to set, includeSubDomains, and the Apache and nginx lines to add.
    
    ](https://mysites.guru/tools/security-headers/strict-transport-security/)
-   [
    
    ### X-Content-Type-Options
    
    X-Content-Type-Options: nosniff stops browsers guessing a file's type, closing a route for smuggling scripts past uploads. The Apache and nginx lines to add.
    
    ](https://mysites.guru/tools/security-headers/x-content-type-options/)

## More from the blog

[

![Check your site's security headers](https://mysites.guru/_astro/mySites.guru-REFRESH-BLACK-13-1024x538.TbklMHsm_1rleEI.webp)

### Check your site's security headers

mySites.guru checks eight HTTP security headers on every snapshot - CSP, HSTS, X-Frame-Options and more - to help you harden against XSS and clickjacking.

](https://mysites.guru/blog/check-your-websites-security-headers-with-mysites-guru/)

## See where your own sites stand

One free audit of one site · no card · about 2 minutes to connect

[Get Your Free Site Audit](https://manage.mysites.guru/en/register)

[How the X-Frame-Options check works](#how-the-x-frame-options-check-works) [A click that isn’t going where it looks](#a-click-that-isnt-going-where-it-looks) [The value to set, and the one to avoid](#the-value-to-set-and-the-one-to-avoid) [Adding the X-Frame-Options header](#adding-the-x-frame-options-header) [Why framing rules are left to you](#why-framing-rules-are-left-to-you) [Further Reading](#further-reading) [Frequently Asked Questions](#faq)