Description
The absence of the X-Frame-Options HTTP response header leaves a website vulnerable to click-jacking attacks. Without this header, attackers can embed the site’s content into malicious pages using iframes, potentially leading to phishing attacks or unauthorized transactions.
Recommendation
To mitigate this vulnerability, configure your server to send the X-Frame-Options header with an appropriate setting for all pages. Common settings include DENY, SAMEORIGIN, or ALLOW-FROM followed by a specific URI. Choose the setting that best fits your application’s requirements. Ensure proper testing to verify that the header is correctly implemented and enforced by all browsers.
References
Could your website be exposed too?
SmartScanner can check your website for X-Frame-Options Header is Missing and gives you actionable findings to investigate.
Start a free scanRelated Issues
- X-Content-Type-Options Header is Missing - Vulnerability
- Strict-Transport-Security Header is Missing - Vulnerability
- Content-Security-Policy Header is Missing - Vulnerability
- X-XSS-Protection Header is Missing - Vulnerability
