HTTP Header Field X-Frame-Options
D. Ross, T. Gondrom · 2013-10
Abstract
To improve the protection of web applications against clickjacking, this document describes the X-Frame-Options HTTP response header field, which declares a policy communicated from a host to the client browser on whether the browser must not display the transmitted content in frames from other sites.
Why This RFC Matters
RFC 7034 standardized X-Frame-Options, a widely deployed but previously non-standard HTTP header that major browsers had already implemented to combat clickjacking attacks — where an attacker embeds a target site in a transparent iframe to trick users into clicking on concealed elements. By specifying DENY, SAMEORIGIN, and ALLOW-FROM directives, the header gives site operators granular control over framing. Although the more powerful Content Security Policy 'frame-ancestors' directive has largely superseded it, X-Frame-Options remains a recommended defense-in-depth header in every major web security checklist and scanner.