Checks · HDR-003

HDR-003 · Clickjacking: no frame-ancestors or X-Frame-Options

Why it matters

Without a frame policy, another site can embed yours and trick a signed-in person into clicking.

How we detect it

Neither frame-ancestors nor X-Frame-Options is present.

How we fix it

Set frame-ancestors to 'none' or 'self', or set X-Frame-Options.

Can it be fixed automatically? Yes, with a template change

Related checks

• SEC-007 · Source maps public in production
• DB-008 · Migrations not in repo
• HDR-001 · Missing HSTS
• HDR-002 · Missing CSP