How do I stop my website being embedded in another site?
Any site can put your pages inside a frame on its own page, and attackers use this for clickjacking: your login form or a "confirm" button is loaded invisibly over something else, so a visitor clicks it without knowing. The X-Frame-Options header, or the frame-ancestors rule in a content security policy, tells browsers to refuse to display your pages inside other sites. Unless you deliberately embed your pages elsewhere, set it to deny.
Why it matters
Clickjacking is simple and effective. A page on another site shows a game or a prize button, and your site's "delete account", "confirm order" or "like" button sits transparently on top of it. The visitor is logged in to your site, so the click counts. Framing is also used to wrap your site in someone else's branding and adverts, so your content earns them money.
How to check
Our check looks for either the X-Frame-Options header or a frame-ancestors rule in the Content-Security-Policy header on your home page. Free tools such as securityheaders.com report the same.
How to fix it
Add the header "X-Frame-Options: SAMEORIGIN", which allows your own pages to frame each other but blocks everyone else, or "DENY" if you never use frames. The modern equivalent is "frame-ancestors 'self'" in a content security policy, and browsers prefer it when both are present. On Apache it is one line in the .htaccess file; hosting panels, content delivery networks and WordPress security plugins have a setting for it. WordPress already sends it on admin pages, but not on the public site.
If you do embed your pages in a partner's site, list that partner's domain in frame-ancestors rather than leaving the door open to everyone.
Not sure how your own site does on this? Run the free check: it takes about twenty seconds and reports on this and thirty other things.