Agent WranglersAPS-28Required
Refuse to be framed
Stop other sites from showing yours inside a frame. Use frame-ancestors 'none' (or a list) in the CSP, plus X-Frame-Options for older browsers.
How to do it
Add frame-ancestors 'none' to the Content-Security-Policy header and send X-Frame-Options: DENY. If partners must embed you, list their origins instead. This directive works without a strict script policy. Send it on day one, even before Allow only the scripts you wrote is ready. When both are ready, they share one header. Test it with the attack in Send the security headers as one set.
Examples
HTTP example
Content-Security-Policy: frame-ancestors 'none'
X-Frame-Options: DENYHow to check
curl -sI on a page and an error page shows frame-ancestors in the CSP and X-Frame-Options. A test page on another origin that frames the site shows a blocked frame.
Sources
Related rules
- APS-25 Allow only the scripts you wrote in Application security
- APS-100 Send the security headers as one set in Application security
- APS-39 Check the sender of every window message in Application security
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/browser-security-headers/frame-ancestors">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.