Skip to main content
Security Auditor — checks that the audited page sends X-Frame-Options: DENY or SAMEORIGIN, or a Content-Security-Policy with frame-ancestors, so other sites cannot embed it in a frame.

Protection

Stops attackers from loading your page in a hidden frame and tricking visitors into clicking it.

Standards

Follows the X-Frame-Options section of the WHATWG HTML Living Standard and honors CSP frame-ancestors.
In a clickjacking attack, a malicious page loads your site in an invisible frame and places its own buttons on top, so a visitor who thinks they are clicking the attacker’s page is really clicking yours: confirming a payment, changing a setting or sharing data. Browsers refuse to frame a page that forbids it with X-Frame-Options or with the frame-ancestors directive of Content-Security-Policy. This auditor reads both headers from the audited URL.

​
How it works

  1. Fetch — sends a HEAD request (or GET when HEAD is not supported) to the audited URL as 37AuditsBot. A blocked request ends the audit with 590; any other failure (timeout, DNS, TLS, non-2xx answer) ends it with 500.
  2. CSP first — when an enforced Content-Security-Policy header (not Content-Security-Policy-Report-Only) has a frame-ancestors directive, browsers ignore X-Frame-Options, so the page passes. A frame-ancestors * alone allows every site and does not count.
  3. Read — like browsers, collects every X-Frame-Options header line, splits it on commas, trims and lowercases each value and drops duplicates. DENY, DENY is read as deny.
  4. Rules — a missing header (400), the obsolete ALLOW-FROM (401) and any other value that is not DENY or SAMEORIGIN, such as ALLOWALL (402), fail. Several distinct values that include DENY, SAMEORIGIN or ALLOWALL warn (300): browsers then block every frame.
  5. Aggregate — FAIL wins over WARNING; when every rule passes the audit is SUCCESS (200).
  6. Specification pin — every run emits 37A-XFrameOptionsAuditor-100 (INFORMATION), naming the X-Frame-Options section of the WHATWG HTML Living Standard as of 2026-10-15. It does not change the overall status.

​
What it audits

Every row maps to one checkRule* method and one CheckCode, in the order the auditor runs them. CheckCode suffixes use status ranges: 100 information, 200 success, 300–399 warning, 400–499 fail, 500–599 error.

​
Output documentation

​
Risks and considerations

​
Why clickjacking matters

  • Any page where a single click does something (buy, delete, transfer, share, change a password or a permission) can be abused while it sits in a hidden frame on another site.
  • Login and account pages are the most valuable targets, but the protection is cheap enough to send on every page.

​
DENY, SAMEORIGIN or CSP

  • DENY forbids every frame; SAMEORIGIN allows only pages of your own origin.
  • ALLOW-FROM was never supported by Chrome or Safari and Firefox dropped it, so it gives no protection. To allow specific partner sites, use Content-Security-Policy: frame-ancestors 'self' https://partner.example.
  • When frame-ancestors is present, browsers ignore X-Frame-Options. Many sites send both so older browsers stay protected.

​
Duplicate headers

  • A web server and a CDN or proxy that both add the header produce values such as SAMEORIGIN, DENY. Browsers treat that as a conflict and refuse every frame, which can break pages you embed yourself.

​
What this auditor does not check

  • Only the audited URL is fetched; other pages of the site may be sent without the header.
  • Content-Security-Policy set in an HTML <meta> tag is not read: browsers ignore frame-ancestors there.
  • The sources listed in frame-ancestors are not judged, apart from a lone *.