Apache Set X-Frame-Options

Website security is a top priority for web developers. One way to help protect your website against cross-site attacks is by setting the X-Frame-Options header in Apache.

What is X-Frame-Options?

X-Frame-Options is an HTTP header that is used to protect against clickjacking attacks. Clickjacking, also known as UI redress attack or a host of other names, is a malicious technique of tricking a web user into clicking on something different to what they intended, by means of a hidden element in the web page.

How to set X-Frame-Options in Apache

To set the X-Frame-Options header, add the following code to your Apache configuration file:

Header always set X-Frame-Options "SAMEORIGIN"

The "SAMEORIGIN" option prevents the web page from being displayed in a frame from a different origin. This option is the most secure but may prevent some legitimate uses of frames.

If you want to allow your website to be displayed in frames on a specific site, you can use the "ALLOW-FROM" option. For example, to allow the web page to be displayed in a frame on https://www.example.com, use the following code:

Header always set X-Frame-Options "ALLOW-FROM https://www.example.com"

Conclusion

Setting the X-Frame-Options header in Apache is a simple way to add an extra layer of security to your website. It can help protect your website against clickjacking attacks and keep your users safe.