XFO prevents clickjacking. DENY = never frameable; SAMEORIGIN = only on the same site. Largely superseded by CSP's frame-ancestors.
X-Frame-Options
HTTP header that controls whether a page can be loaded in an iframe.
HTTP header that controls whether a page can be loaded in an iframe.
XFO prevents clickjacking. DENY = never frameable; SAMEORIGIN = only on the same site. Largely superseded by CSP's frame-ancestors.