What is X-Frame-Options?

Short answer

X-Frame-Options is the response header that tells the browser whether the page can be shown inside an iframe on other pages. Its purpose is to prevent clickjacking: the attacker cannot place the page in an invisible iframe on their own site and get the user to click buttons without noticing. DENY allows no framing, and SAMEORIGIN allows framing only by pages in the same origin. In TR7, when X-Frame-Options ("SAMEORIGIN") is selected in the Response Headers list of the Manage HTTP Security Headers action, the header is written with the SAMEORIGIN value to the responses coming from the Backend Service; the X-Frame-Options value that the Backend Service sends is replaced with this value.

Where It Is Used in TR7

Where	Field / label	What for
Load Balancer → Actions (Policy Actions) → Manage HTTP Security Headers form	Response Headers → X-Frame-Options ("SAMEORIGIN")	Allowing framing only by pages in the same origin
Load Balancer → Actions (Policy Actions) → Set HTTP Header form	Set HTTP Header	Writing a different value such as DENY at the response stage

Values

Value	Effect	In TR7
DENY	The page is not shown inside any iframe	Written with Set HTTP Header
SAMEORIGIN	Only pages in the same origin can show it inside an iframe	The fixed value of the Manage HTTP Security Headers option

X-Frame-Options is defined in RFC 7034; its current equivalent is the frame-ancestors directive in Content-Security-Policy (W3C CSP Level 3). TR7's Content-Security-Policy option does not write frame-ancestors (What is Content-Security-Policy (CSP)?).

Common Misconceptions

• "X-Frame-Options blocks the iframes inside the page." The header controls the page itself being shown inside an iframe on other pages; it does not affect the iframes that the page embeds.
• "My own subdomains can show the page inside an iframe." SAMEORIGIN allows only the same origin; if the scheme, domain or port is different (subdomains included), the origin is different.
• "The header is also added to the pages that TR7 produces." The action is applied only to the responses coming from the Backend Service; blocking and error pages do not get this header.

How it is done in the documentation

• Manage HTTP Security Headers · The Security Headers That Can Be Selected
• Manage HTTP Security Headers · Overwriting the Existing Headers

Related questions

• Can I add security headers (CSP, HSTS, X-Frame-Options) without touching the backend?
• What are HTTP security headers?
• What is Content-Security-Policy (CSP)?