thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

X-Frame-Options (XFO)

A legacy HTTP response header that controls whether a page may be displayed in a frame, used to prevent clickjacking.

Definition

Valid values are DENY and SAMEORIGIN (ALLOW-FROM is obsolete). CSP's frame-ancestors directive supersedes it, but both are often sent for compatibility.

Example

X-Frame-Options: DENY

Exam tip

XFO is the classic clickjacking answer; frame-ancestors is the modern one.

Related terms