Header Security

Shopify X-Frame-Options Header Check

The X-Frame-Options header is essential to protect your Shopify store against clickjacking. Check its presence and learn how to configure it effectively.

What this test checks

This test checks whether the X-Frame-Options header is present on your Shopify store. This header prevents your site from being embedded in iframes by third‑party sites, protecting against clickjacking attacks. Without it, an attacker can overlay elements on your site to trick your customers.

Our recommendation

Add the X-Frame-Options header with the value 'SAMEORIGIN' in your Shopify server configuration. Use Shopify's built‑in security settings to configure this header. Test your configuration with browser developer tools.

Security tests

View all tests

Server Configuration

Shopify X-Frame-Options Header Check

What this test checks

Our recommendation

Read more

Database Administration Tools Access Check

Shopify Registration CAPTCHA Protection Check

PrestaShop Session Cookie Security Check

Joomla Admin Access Check

Magento Git File Exposure Check

Shopify SQL Injection Protection Check

Cross-Origin-Opener-Policy Header Check

WordPress Upload Folder Indexing Check (wp-content/uploads/)

WordPress Theme Editor Access Check

PHP Error Display in Production Check

WordPress REST API Access Check

Shopify REST API Exposure Check

Upload Folder Protection Check (.htaccess, index.html files)

Shopify HSTS Header Check

Drupal Backup File Exposure Check

Shopify File Upload Security Check

CORS Configuration Check (Access-Control-Allow-Origin)

Joomla Cron Access Check

PrestaShop Admin Access Check

Shopify Admin Access Restriction Check

Joomla Admin Login Page Protection Check

Shopify Log File Exposure Check

Clear-Site-Data Header Check

Information Leak via HTTP Headers Check

Index File Presence in Upload Folders Check

Shopify phpinfo Exposure Check

Joomla Temporary Folder (/tmp/) Access Check

Database Backup File Exposure Check

Upload Folder Indexing Check

Shopify Content-Security-Policy Header Check

Joomla REST API Access Check

Shopify Upload Folder Security Check

Login Attempt Limiting Check

Magento Admin Login Page Protection Check

Shopify Contact Form CAPTCHA Protection Check

Drupal Admin Login Page Protection Check

Cookie Security Check

wp-config.php File Access Check

Referrer-Policy Header Check

Shopify Password Protection Check

Shopify HTTP Security Headers Check

Magento env.php File Access Check

robots.txt File Check

Known CVE Vulnerability Check on Used Technologies

Drupal Log File Exposure Check

WordPress Login Page Access Check (wp-login.php)

Shopify XSS Protection Check

PrestaShop Upload Folder Indexing Check

X-Content-Type-Options: nosniff Header Check

HttpOnly Flag on Joomla Session Cookies Check

CAPTCHA Presence on Registration Page Check

CMS Vulnerability Check

PrestaShop Admin Access Restriction Check

Shopify Password Reset CAPTCHA Protection Check

PHP Error Display on Magento Check

Authentication File Exposure Check (.htpasswd, .user.ini)

PrestaShop Version Check

Configuration File Exposure Check

Cookie Policy Page Presence Check

PHP Error Display on Drupal Check

Magento Cache Folder Access Check

Shopify Terms and Conditions (T&C) Presence Check

Email Address Exposure Check

WordPress Backup File Exposure Check

Shopify Permissions-Policy Header Check

WordPress Debug Log Exposure Check

Installation Log File Exposure Check

CNIL Mention in Privacy Policy Check

Content-Security-Policy Header Check

SSL Certificate Check

CAPTCHA Presence on Public Forms Check

X-Frame-Options Header Check

PrestaShop parameters.php File Access Check

CAPTCHA Presence on Admin Page Check

Shopify X-Content-Type-Options Header Check

Magento Admin Access Restriction Check