Checks · security

Missing X-Frame-Options Header

Opportunity security.missing_x_frame_options

What it means

Nothing stops another site framing this page, which is how clickjacking works. Either X-Frame-Options or a Content-Security-Policy frame-ancestors directive prevents it.

How to fix it

Send X-Frame-Options: SAMEORIGIN, or add frame-ancestors to the Content-Security-Policy.

Where to find it in Truelint

Open the Issues pane on the right of the workspace and select Missing X-Frame-Options Header. The grid filters to every affected URL and the detail pane shows the specific finding for each. Export the list with Export → Current view, or from the API:

GET /api/v1/crawls/{handle}/issues/security.missing_x_frame_options