Checks for X-Frame-Options and CSP frame-ancestors to prevent clickjacking attacks.
This check verifies that your site is protected against clickjacking — an attack where an attacker embeds your page in an invisible iframe on their malicious site and tricks users into clicking on hidden elements. Protection is provided by the `X-Frame-Options` header and/or CSP `frame-ancestors` directive.
Clickjacking can trick users into performing unintended actions on your site (like changing settings, making purchases, or granting permissions) while they think they're interacting with a different page. This is especially dangerous for pages with sensitive actions.
Without clickjacking protection, attackers can overlay your site with invisible elements, tricking users into performing sensitive actions. This can lead to account compromise, unauthorized transactions, and data theft.
# Option 1: X-Frame-Options header
X-Frame-Options: DENY
# or
X-Frame-Options: SAMEORIGIN
# Option 2: CSP frame-ancestors (more flexible, recommended)
Content-Security-Policy: frame-ancestors 'self'Run a free audit to see how your site performs on Clickjacking Protection and 159 other checks.
Start Free AuditVerifies the validity and configuration of the SSL certificate.
Checks if the site is secured with a valid SSL certificate.
Ensures that HTTP traffic is automatically redirected to HTTPS.
Checks for insecure (HTTP) resources on a secure (HTTPS) page.