How to Configure X-Frame-Options in Apache

How to Configure X-Frame-Options in Apache

1. 'SAMEORIGIN' – With this setting, you can embed pages on same origin. For example, add iframe of a page to site itself.
2. 'ALLOW-FROM uri – Use this setting to allow specific origin (website/domain) to embed pages of your site in iframe.
3. 'DENY – This will not allow any website to embed your site pages in an iframe.

1. How do I set X-Frame-options?
2. How do I set X-Frame-options in web config?
3. Where do I put X-Frame-options header?
4. What is X Frame option?

How do I set X-Frame-options?

1. On Apache: To send the X-Frame-Options to all the pages of same originis, set this to your site's configuration. Header always set X-Frame-Options "sameorigin" ...
2. On Nginx: Open the server configuration file and add the following code to allow only from same origin. add_header x-frame-options "SAMEORIGIN" always;

How do I set X-Frame-options in web config?

To configure IIS to add an X-Frame-Options header to all responses for a given site, follow these steps:

1. Open Internet Information Services (IIS) Manager.
2. In the Connections pane on the left side, expand the Sites folder and select the site that you want to protect.

Where do I put X-Frame-options header?

The X-Frame-Options header is added on the server-side, not the client. This is because the header is used to control how the browser should render the page. Whatever server is hosting your file would have to add this header.

What is X Frame option?

X-Frame-Options allows content publishers to prevent their own content from being used in an invisible frame by attackers. The DENY option is the most secure, preventing any use of the current page in a frame. More commonly, SAMEORIGIN is used, as it does enable the use of frames, but limits them to the current domain.