The HTTPS site does not restrict who may frame it.

FRAME_PROTECTION_MISSING · Severity: Info

• InfoFRAME_PROTECTION_MISSING

  The HTTPS site does not restrict who may frame it.

  There is neither an X-Frame-Options header nor a frame-ancestors directive in an enforced Content Security Policy. Other sites can then show the page in a frame and trick visitors into clicking on it (clickjacking).

  Recommendation: Send Content-Security-Policy: frame-ancestors 'self' (or X-Frame-Options: SAMEORIGIN) unless the page is meant to be framed.

Reported by

• Security headers check
• Site health check

Available through the API

• Security headers check API
• Site health check API

All findings