Framing protections help control which pages may embed a website. Review them alongside the actions available on sensitive pages.
The following checks provide related public observations. Their presence does not mean this entire topic has been tested or that the application is secure.
Checks for frame-ancestors in CSP or X-Frame-Options. Severity rises when the page has a login.
Send Content-Security-Policy: frame-ancestors 'self' (or X-Frame-Options: SAMEORIGIN for older browsers).
A blocked or unfinished check remains unverified. Review technical recommendations with the person operating the website and test changes before applying them to a live service.
Read the full methodology