snag.page

Every check ยท Headers

Framing

headers/framing

What it checks

CSP frame-ancestors, or X-Frame-Options.

Why it matters

Without either, another site can show this one in a frame and trick visitors into clicking on it.

How to fix it

  1. Add frame-ancestors 'self' to the CSP, or send X-Frame-Options: SAMEORIGIN.
Header
Content-Security-Policy: frame-ancestors 'self'

Check a site for this and everything else: snag.page. More on headers: Bot challenge Content-Security-Policy nosniff Referrer policy Software versions End-of-life software CORS Permissions-Policy Cross-Origin-Opener-Policy