miji.beX-Frame-Options is an HTTP response header that indicates whether a browser should be allowed to render a page in a frame, iframe, embed, or object element. It was introduced as a defense against clickjacking attacks and is supported by all modern browsers.
The header has two directives in current use: DENY (the page cannot be displayed in any frame) and SAMEORIGIN (the page can only be framed by pages from the same origin). A third directive, ALLOW-FROM uri (allow framing by one specified origin), is obsolete; according to the MDN reference (as of July 2026), modern browsers ignore the entire header when they encounter it, so using it silently removes the protection. To allow a specific origin, use the CSP frame-ancestors directive instead. Note also that X-Frame-Options only works as an HTTP response header; setting it in a meta http-equiv tag has no effect.
While X-Frame-Options remains widely used, the frame-ancestors directive in Content Security Policy (CSP) is the modern replacement. CSP's frame-ancestors offers more flexibility, supporting multiple origins and wildcard patterns. When both are present, the CSP specification (Level 2) says frame-ancestors should be enforced and X-Frame-Options ignored. If you set both to cover older environments that do not understand frame-ancestors, keep the two values consistent so that protection holds in environments that read only one of them.
For URL shortening services, setting X-Frame-Options to DENY or SAMEORIGIN on the management dashboard and content pages prevents these pages from being embedded in malicious sites. The redirect endpoints typically do not need frame protection since they immediately redirect rather than displaying content.