Clickjacking protection

What this check looks for

This check first looks for an X-Frame-Options header on the homepage response; if present, it passes. If absent, it checks the Content-Security-Policy header for a frame-ancestors directive, which also passes if found. If neither protection is present, it warns.

Why it matters

Without either protection, another site can embed your page inside a hidden or disguised iframe and trick visitors into clicking something on your page while believing they're interacting with the surrounding site — a technique called clickjacking, commonly used to hijack likes, follows, or even form submissions on the underlying page without the visitor's knowledge. X-Frame-Options (or the more flexible CSP frame-ancestors directive) tells browsers to refuse rendering your page inside a frame on an untrusted origin, closing that attack off entirely. Like the other header checks here, this is a security hardening measure rather than a direct ranking or AI-visibility factor, but it protects the same visitors and brand reputation that good rankings are meant to earn traffic for.

How to fix it

Send one of the two protections on every response:

X-Frame-Options: SAMEORIGIN

Content-Security-Policy: frame-ancestors 'self'

Use frame-ancestors if you're already maintaining a CSP, since it's more flexible (it can allow specific trusted origins) than the older, blunter X-Frame-Options header.