Agent Wranglers

Security Required

Refuse to be framed

Stop other sites from showing yours inside a frame. Use frame-ancestors 'none' (or a list) in the CSP, plus X-Frame-Options for older browsers.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Add frame-ancestors 'none' to the CSP and send X-Frame-Options: DENY. If partners must embed you, list their origins instead.

Example

Content-Security-Policy: frame-ancestors 'none'
X-Frame-Options: DENY

How to check

curl -sI on a page and an error page shows frame-ancestors in the CSP and X-Frame-Options. A test page on another origin that frames the site shows a blocked frame.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers website playbook: https://agentwranglers.se/playbook/website/security/frame-ancestors.