Clickjacking protection

What this means

Passing means your response carries X-Frame-Options, or your CSP carries frame-ancestors, so browsers refuse to show your pages inside another site's frame. Failing means neither is set and any page on the web can embed yours. If you have a page that must be embeddable, the kit shows how to override only that route.

How we test it

We read the headers on the home page response. An x-frame-options header, or a frame-ancestors directive inside content-security-policy, passes. Neither present fails. We do not grade the value beyond its presence; DENY and frame-ancestors 'none' are what the kit ships, and together they cover old and new browsers.

Why it matters

Without it the site can be framed inside an attacker's page. The attacker lays your real page, invisible, over a decoy, and the visitor's click lands on your button: a payment, a delete, a consent. Nothing about this looks wrong to the visitor or in your logs. The header costs nothing and is part of the template set the kit applies to every route.

The fix

Add X-Frame-Options: DENY to the /(.*) headers block in vercel.json or to securityHeaders in next.config.ts, and keep frame-ancestors 'none' in the CSP alongside it; if one route must be embeddable, override only that route as the commented example in next-config-headers.ts shows. Confirm with curl -sI https://YOUR_DOMAIN | grep -i '^x-frame-options', expected x-frame-options: DENY. The full runbook is in the Fix Kit, Module 01.

Prompt for your AI

Paste this into the coding agent that built the app. It reproduces the finding and stops before changing anything; the fix steps are in the kit.

Do not change anything. This is a verification pass.
Run: curl -sI https://YOUR_DOMAIN | grep -iE '^(x-frame-options|content-security-policy)' and show me the output.
Tell me whether an x-frame-options header is present, and whether the CSP contains a frame-ancestors directive, quoting each.
Open vercel.json or next.config at the repo root and show me any X-Frame-Options entry, or tell me there is none.
Tell me whether any route on this site needs to be embedded in another site's page.
List what it would take to add the header to every route, and stop there.
Run: curl -sI https://YOUR_DOMAIN | grep -ic '^x-frame-options' and show me the output. Expected on a passing site: 1.