Clickjacking protection missing

Check id: hdr.frame_missing · fix effort: low

What it means

Other sites can invisibly embed yours and trick visitors into clicking things they can't see. One header stops it.

The technical detail

Neither X-Frame-Options nor CSP frame-ancestors is set.

How to fix it

  1. Add X-Frame-Options: DENY (or SAMEORIGIN), or CSP frame-ancestors 'none'.

Does your domain have this problem?

Run a free scan, takes about ten seconds.