Can your site be framed by someone else?
Clickjacking hides your real page inside an invisible frame on another site, so a visitor clicks your buttons without knowing it. Paste a URL to see whether other sites can frame it, and whether that puts your visitors at risk.
- X-Frame-Options
- CSP frame-ancestors
This is the URL loaded in a frame on our page, just as an attacker would. If you can see the page, any site can do the same. If the frame shows an error such as "refused to connect", your browser blocked it.
This URL uses plain http, which browsers will not load inside an https page, so the frame stays empty either way. Go by the header verdict above.
How to fix it
Send a Content-Security-Policy with frame-ancestors, plus X-Frame-Options for older browsers. Add both on the web server in front of your site.
nginx
add_header Content-Security-Policy "frame-ancestors 'self'" always;
add_header X-Frame-Options "SAMEORIGIN" always;Apache
Header always set Content-Security-Policy "frame-ancestors 'self'"
Header always set X-Frame-Options "SAMEORIGIN"Running Odoo? Use 'self' rather than 'none': the website editor shows your own pages in a frame on the same domain. CICDoo turns these headers on by default for every instance it deploys.
How the attack works
Your page, someone else's clicks
An invisible frame
The attacker loads your real page in a transparent iframe and lays it over a decoy, such as a prize button or a video player.
A real click
The visitor is already signed in to your site. Their click lands on your page: approving a payment, changing an email or granting access.
One header stops it
frame-ancestors or X-Frame-Options tells the browser which sites may frame you. Without it, the browser lets anyone.
FAQ
Questions, answered
What does this test check?
We request the URL from our server and read two response headers: X-Frame-Options and the frame-ancestors directive of Content-Security-Policy. The page also loads the URL in a frame so you can see the result in your own browser.
Which header should I use?
frame-ancestors is the modern standard and wins whenever it is present. Keep X-Frame-Options as well for older browsers. Use 'self' to allow only your own domain, or 'none' to block every frame.
Why does the frame look blank?
Some sites block framing, show a blank page for unknown visitors, or use plain http, which browsers refuse to load inside an https page. The header verdict does not depend on your browser.
Is my site vulnerable if it can be framed?
Not necessarily. Clickjacking needs a page with an action that matters, such as a payment or a settings change, a visitor who is signed in, and a session cookie the browser sends inside a frame on another site. Current browsers hold back cookies without SameSite=None, so a framed page usually loads signed out. The headers are still worth adding: they close the door for good and security audits check for them.
Is ALLOW-FROM still supported?
No. Current browsers ignore X-Frame-Options ALLOW-FROM. To allow specific partner sites, list them in frame-ancestors instead.
Do you store the URL?
We keep only a rate-limit record of the request, not the URL or the result.
Security headers you never have to remember.
CICDoo runs Odoo on servers you own, with framing protection, SSL, two-factor login, backups and a daily security scan of every instance.
No per-seat fees. Your servers stay yours.