X-Frame-Options Generator
Generate frame protection headers.
Keep or share the finished result
Copy or share after running the tool. Saved tools and settings stay in this browser.
What would you like to do next?
Generate X-Frame-Options
Frame protection helps reduce clickjacking risk by controlling whether a page can be embedded in another site. Choose DENY or SAMEORIGIN to generate a classic X-Frame-Options header plus a CSP frame-ancestors starter. It is useful for login pages, dashboards, admin tools and account pages.
Clickjacking protection
Check legitimate embeds before using the most restrictive value.
Frequently asked questions
What does X-Frame-Options do?
It controls whether a browser can display the page inside a frame.
What is SAMEORIGIN?
It allows framing only by pages from the same origin.
Should I also use CSP frame-ancestors?
Many modern deployments use CSP frame-ancestors alongside or instead of X-Frame-Options.