Header Security

X-Frame-Options Header Check

Learn how the X-Frame-Options header prevents your site from being embedded in malicious iframes and protects your users against clickjacking attacks.

What this test checks

This test checks for the presence and configuration of the X-Frame-Options header. It prevents your site from being embedded in an iframe on a third‑party site, protecting your users against clickjacking attacks where an attacker overlays invisible elements on your site to trick the user.

Our recommendation

Configure your server to add the X-Frame-Options header with the value 'SAMEORIGIN' to allow embedding only from your own domain. Example Apache: 'Header always append X-Frame-Options SAMEORIGIN'. For Nginx: 'add_header X-Frame-Options SAMEORIGIN'. Avoid 'ALLOW-FROM' which is obsolete.

Security tests

View all tests

CMS Security

X-Frame-Options Header Check

What this test checks

Our recommendation

Read more

WordPress Theme Editor Access Check

CORS Configuration Check (Access-Control-Allow-Origin)

CAPTCHA Presence on Public Forms Check

Authentication File Exposure Check (.htpasswd, .user.ini)

HSTS Header Check (HTTP Strict Transport Security)

Magento Admin Login Page Protection Check

Drupal Admin Access Restriction Check

xmlrpc.php Access Check

Shopify Environment Information Exposure Check

CAPTCHA Presence on Contact Form Check

WordPress Upload Folder Indexing Check (wp-content/uploads/)

Shopify X-Frame-Options Header Check

PrestaShop Admin Access Check

Shopify Upload Folder Security Check

PrestaShop Upload Folder Indexing Check

Shopify XSS Protection Check

Joomla Cron Access Check

Magento Admin Access Restriction Check

PrestaShop Version Check

WordPress Version Check

Referrer-Policy Header Check

Upload Folder Indexing Check

Server Status Pages Access Check

robots.txt File Check

Shopify Terms and Conditions (T&C) Presence Check

Privacy Policy Page Presence Check

Drupal Log File Exposure Check

Joomla Admin Login Page Protection Check

Joomla REST API Access Check

Drupal Version Check

Two-Factor Authentication (2FA) Check

PHP Error Display on Magento Check

Login Attempt Limiting Check

CAPTCHA Presence on Registration Page Check

Magento Session Cookie Security Check

Joomla configuration.php Exposure Check

WordPress Admin Access Check

Magento Cache Folder Access Check

Cache Policy Check (Cache-Control, Pragma, Expires)

.htaccess File Presence and Security Check

Shopify Permissions-Policy Header Check

Cross-Origin-Resource-Policy Header Check

Drupal Upload Folder Indexing Check (sites/default/files/)

PHP Error Display in Production Check

Drupal Admin Access Check

Joomla Temporary Folder (/tmp/) Access Check

Drupal Admin Login Page Protection Check

PHP Error Display on WordPress Check

Magento Configuration File Exposure Check

Cross-Origin-Opener-Policy Header Check

Shopify Admin Access Restriction Check

Magento Backup File Exposure Check

Shopify Registration CAPTCHA Protection Check

Shopify Admin CAPTCHA Protection Check

Shopify Cart Endpoint Exposure Check

wp-config.php File Access Check

Shopify Contact Form CAPTCHA Protection Check

Joomla Admin Access Check

Clear-Site-Data Header Check

HttpOnly Flag on Joomla Session Cookies Check

Permissions-Policy Header Check

Joomla configuration.php File Access Check

SQL Query Exposure Check

PrestaShop Session Cookie Security Check

Drupal Temporary Folder (tmp/) Access Check

Shopify File Upload Security Check

Shopify SSL/TLS Configuration Check

Cookie Policy Page Presence Check

WordPress Uploads Folder Protection Check (.htaccess, index.html files)

Joomla Log File Exposure Check

CAPTCHA Presence on Client Login Page Check

Shopify Error Display Check

Drupal settings.php File Access Check

Plaintext Password Exposure Check

Directory Indexing Check

Joomla Version Check