X Frame Options
DevOps & Securityx-frame-optionsX Frame Options is an Agent Skill for devops & security published in the thedaviddias/Front-End-Checklist repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Use when reviewing HTTP response headers for clickjacking protection on any web application with authenticated user actions.
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/thedaviddias/Front-End-Checklist/blob/HEAD/skills/x-frame-options/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/x-frame-options, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
Set an X-Frame-Options header
Without framing protection, an attacker can embed your banking login page in a transparent iframe on a malicious site and trick users into clicking buttons they cannot see — transferring money, changing settings, or leaking credentials.
Quick Reference
- Use
X-Frame-Options: DENYto prevent all framing, orSAMEORIGINto allow framing only from your own domain ALLOWFROMis obsolete and unsupported in modern browsers — use CSPframe-ancestorsinstead- The modern equivalent is
Content-Security-Policy: frame-ancestors 'none'— prefer CSP for new sites - Both headers can coexist: X-Frame-Options for older browsers, frame-ancestors for modern ones
- Clickjacking attacks trick users into clicking invisible iframe buttons — DENY eliminates this entirely
Check
Check whether the server sends an X-Frame-Options header (DENY or SAMEORIGIN) or a Content-Security-Policy header with frame-ancestors directive to prevent clickjacking.
Fix
Add X-Frame-Options: DENY to all responses if the site does not need to be embedded anywhere. If legitimate framing is needed on the same origin, use SAMEORIGIN. For fine-grained control, use CSP frame-ancestors instead.
Explain
Explain what a clickjacking attack is, how X-Frame-Options and CSP frame-ancestors prevent it, and the difference between DENY and SAMEORIGIN values.
Code Review
Review server config, headers, forms, and integration points related to Set an X-Frame-Options header. Flag exact responses, cookies, or browser behaviors that violate the rule, and verify them against the effective production-like response.
For full implementation details, code examples, and framework-specific guidance,
see references/rule.md.
Rule page: https://frontendchecklist.io/en/rules/security/x-frame-options