How to remediate – Missing ‘X-Frame-Options’ Header

Contents

1. Introduction

The Missing ‘X-Frame-Options’ Header vulnerability means a web server isn’t telling browsers whether it’s safe to display its content within an iframe on another website. This allows attackers to trick users into performing actions they didn’t intend, potentially revealing sensitive information or gaining control of their accounts. Websites that handle user logins or financial transactions are most at risk. A successful attack could compromise confidentiality, integrity, and availability.

2. Technical Explanation

Clickjacking attacks work by embedding a vulnerable website within an invisible iframe on a malicious page. Users unknowingly click buttons or links inside the iframe, believing they’re interacting with the legitimate site when they are actually performing actions on the attacker’s page. The absence of the `X-Frame-Options` header allows this framing to occur.

Root cause: The web server is not configured to send the `X-Frame-Options` HTTP response header.
Exploit mechanism: An attacker creates a malicious webpage containing an iframe pointing to the vulnerable website. Users visiting the attacker’s page unknowingly interact with the embedded site, potentially triggering unintended actions. For example, a user might click a button that transfers funds without realising they are on a fake banking page.
Scope: All websites serving content via HTTP(S) are affected if they do not set this header.

3. Detection and Assessment

You can check for the presence of the `X-Frame-Options` header using browser developer tools or command line utilities. A thorough assessment involves scanning all web pages and subdomains.

Quick checks: Use your browser’s developer tools (usually F12) to inspect the HTTP response headers for any page on the website. Look for the `X-Frame-Options` header in the ‘Response Headers’ section.
Scanning: Tools like OWASP ZAP or Burp Suite can automatically scan for missing `X-Frame-Options` headers. These tools will report pages without the header.
Logs and evidence: Web server access logs do not directly indicate this vulnerability, but monitoring for unusual iframe requests might provide indirect clues.

curl -I https://example.com

4. Solution / Remediation Steps

Configure your web server to include the `X-Frame-Options` header in its HTTP responses. This prevents browsers from embedding your content within an iframe on other websites.

4.1 Preparation

Ensure you understand the impact of setting `X-Frame-Options` – it may break legitimate use cases where framing is required. A roll back plan involves reverting the configuration change.
Change windows should be scheduled during low traffic periods, with approval from relevant IT stakeholders.

4.2 Implementation

Step 1: Edit your web server’s main configuration file (e.g., Apache’s httpd.conf or Nginx’s nginx.conf).
Step 2: Add the following line to the appropriate section of the configuration, typically within a `` block for Apache or a `server` block for Nginx.
Step 3: Restart your web server to apply the changes.

4.3 Config or Code Example

Before

# Apache example - no X-Frame-Options header set
<VirtualHost *:80>
    ServerName example.com
    DocumentRoot /var/www/html
</VirtualHost>

After

# Apache example - X-Frame-Options header set to DENY
<VirtualHost *:80>
    ServerName example.com
    DocumentRoot /var/www/html
    Header always set X-Frame-Options "DENY"
</VirtualHost>

4.4 Security Practices Relevant to This Vulnerability

Implementing secure headers is a key practice for preventing clickjacking and other UI redress attacks. Regularly reviewing your web server configuration helps identify and address misconfigurations.

Practice 1: Secure Headers – consistently apply security-related HTTP response headers (e.g., X-Frame-Options, Content-Security-Policy).
Practice 2: Configuration Management – regularly review and audit web server configurations to ensure they adhere to security best practices.

4.5 Automation (Optional)

Configuration management tools like Ansible can automate the addition of `X-Frame-Options` headers across multiple servers.

# Ansible example - add X-Frame-Options header to Apache configuration
- name: Add X-Frame-Options header to Apache virtual host
  lineinfile:
    path: /etc/apache2/sites-available/example.com.conf
    insertafter: '^<VirtualHost *:80>'
    line: 'Header always set X-Frame-Options "DENY"'
  notify: Restart Apache

5. Verification / Validation

Confirm the `X-Frame-Options` header is now present in HTTP responses. Re-test using your browser developer tools and scanning tools. Ensure core website functionality remains unaffected.

Post-fix check: Run curl -I https://example.com and verify that the output includes a line similar to `X-Frame-Options: DENY`.
Re-test: Re-run the scan using OWASP ZAP or Burp Suite. The vulnerability should no longer be reported.
Monitoring: Monitor web server logs for any errors related to header configuration changes.

curl -I https://example.com

6. Preventive Measures and Monitoring

Update your security baselines to include a requirement for the `X-Frame-Options` header. Integrate checks into your CI/CD pipeline to prevent deployments with missing headers.

Baselines: Update your web server hardening baseline or CIS benchmark to require setting the `X-Frame-Options` header.
Pipelines: Add a static analysis check in your CI/CD pipeline that verifies all HTTP responses include the required header.

7. Risks, Side Effects, and Roll Back

Setting `X-Frame-Options` to DENY may break legitimate use cases where framing is required (e.g., some third-party integrations). If issues occur, revert the configuration change.

Risk or side effect 1: Breaking legitimate framing – some applications might rely on embedding your content within an iframe.
Risk or side effect 2: Configuration errors – incorrect header settings can cause unexpected website behaviour.
Roll back: Remove the `Header always set X-Frame-Options “DENY”` line from your web server configuration file and restart the server.

8. References and Resources

Vendor advisory or bulletin: N/A
NVD or CVE entry: N/A
Product or platform documentation relevant to the fix: Updated on December 27, 2025

Was this article helpful?

Yes No