Missing x frame options

Quick win

Add the X-Frame-Options HTTP response header set to DENY or SAMEORIGIN to prevent your store's pages from being embedded in iframes on other sites.

What it is

The X-Frame-Options header is a security instruction your web server sends to browsers telling them whether your pages are allowed to be loaded inside an iframe (an invisible "frame" embedded in another website). When this header is missing, any website in the world can silently embed your store inside their page. The two safe values are DENY (no framing at all) and SAMEORIGIN (only your own domain can frame your pages). Most stores should use SAMEORIGIN unless you have no legitimate need to embed your own pages in iframes, in which case DENY is even stronger.

Why it matters

Without X-Frame-Options, attackers can use a technique called "clickjacking" — they overlay your store's checkout or login page inside an invisible iframe on a malicious site, tricking shoppers into clicking buttons they can't see. This can lead to unauthorized purchases, stolen account credentials, or fraudulent transactions, directly costing you revenue and eroding customer trust. Search engines and security scanners flag this missing header as a vulnerability under OWASP A05:2021 (Security Misconfiguration), which can affect your site's security rating and enterprise buyer trust. Many payment card industry (PCI DSS) compliance checklists also require it, so missing it can jeopardize your ability to process card payments.

How to fix it

  1. Decide on the right value: use DENY if your store pages never need to appear in any iframe, or SAMEORIGIN if you embed your own pages (e.g., a widget on your own domain).
  2. Identify where HTTP response headers are set for your store — this is typically your web server config (Nginx, Apache), your CDN/edge layer (Cloudflare, Fastly), your hosting platform's admin, or a plugin/app.
  3. Add the header: X-Frame-Options: DENY (or SAMEORIGIN) to every HTTP response, not just the homepage — it must cover all pages including checkout and account login.
  4. If your platform supports Content-Security-Policy (CSP), also add frame-ancestors 'none' (equivalent to DENY) or frame-ancestors 'self' (equivalent to SAMEORIGIN) to your CSP header, as modern browsers prefer CSP over X-Frame-Options.
  5. Deploy the change and verify using your browser's developer tools (Network tab → select any page request → inspect Response Headers) or a free header-checker tool to confirm the header appears on all key pages.
  6. Re-run your security scan to confirm the finding is resolved.

Fix it on your platform

Pick your platform for the exact steps.

How to fix missing x frame options on Shopify
  1. Shopify's core storefront automatically sends X-Frame-Options: DENY on all theme pages — if the scanner flagged this on a standard Shopify storefront, it may relate to a custom app proxy, external landing page, or headless front end, not the Shopify-hosted store itself.
  2. For custom Shopify apps or app proxies: in your app's server code (Node/Ruby/PHP), add the header in your HTTP response middleware. Example for Express.js: app.use((req, res, next) => { res.setHeader('X-Frame-Options', 'SAMEORIGIN'); next(); });
  3. If you use a Shopify Hydrogen (headless) storefront, add the header in your Remix/Next.js server config or via your hosting provider (Vercel, Oxygen) — see the Headless / Custom entry below.
  4. For pages hosted outside Shopify (e.g., a custom checkout page), apply the header at the web server or CDN level as described in the Headless / Custom steps.
Full Shopify guide →Official Shopify docs ↗
How to fix missing x frame options on Shopify Plus
  1. Same as Shopify above. Shopify Plus merchants using Checkout Extensibility or custom checkout domains should confirm the header is set on those domains via Cloudflare or their CDN in front of the custom domain.
  2. In Shopify Plus admin, go to Settings → Domains and verify any custom domain is proxied through Cloudflare or another CDN where you can add custom headers (see Cloudflare steps below).
  3. For the Launchpad or Scripts editor, these do not control HTTP headers — header changes must be made at the server/CDN layer.
Full Shopify Plus guide →Official Shopify Plus docs ↗
How to fix missing x frame options on WooCommerce
  1. Install the free WordPress plugin 'HTTP Headers' (by David Gwyer) or 'Security Headers' from the WordPress plugin directory: WP Admin → Plugins → Add New → search 'Security Headers' or 'HTTP Headers' → Install & Activate.
  2. Alternatively, use the popular security plugin Wordfence or iThemes Security, which include security header settings.
  3. With the 'HTTP Headers' plugin: go to Settings → HTTP Headers → Add New Header → Name: X-Frame-Options, Value: SAMEORIGIN → Save.
  4. Manual method (advanced): edit your theme's functions.php or a site-specific plugin and add: add_action('send_headers', function(){ header('X-Frame-Options: SAMEORIGIN'); });
  5. Or add to your server's .htaccess file (Apache): Header always set X-Frame-Options 'SAMEORIGIN' — place this inside the <IfModule mod_headers.c> block.
  6. Verify by visiting your site and checking Network tab in browser DevTools for the X-Frame-Options response header.
Full WooCommerce guide →Official WooCommerce docs ↗
How to fix missing x frame options on BigCommerce
  1. BigCommerce sets some security headers automatically, but custom header configuration requires going through Cloudflare or another CDN/proxy in front of your store.
  2. Log in to Cloudflare (or your CDN) → select your BigCommerce domain → go to Rules → Transform Rules → Response Header Modification.
  3. Create a new rule: match all incoming requests (or specific paths like /checkout), action = Set header, Header name = X-Frame-Options, Value = SAMEORIGIN → Save and Deploy.
  4. If you are not using Cloudflare, contact BigCommerce support to ask whether custom response headers can be set at the platform level for your plan.
  5. Verify with browser DevTools or a header-checker after the CDN rule is live.
Full BigCommerce guide →Official BigCommerce docs ↗
How to fix missing x frame options on Wix
  1. Wix does not provide direct access to HTTP response headers from the admin dashboard — you cannot set X-Frame-Options natively on Wix-hosted sites.
  2. For Wix sites, the best available mitigation is to use Wix's built-in Velo (Wix Code) to add a Content-Security-Policy meta tag equivalent in your site pages, though note that HTTP headers are more reliable than meta tags for framing protection.
  3. Go to your Wix Editor → click 'Dev Mode' (or Velo) → open the site's masterPage.js → use wixWindow or HTTP functions to add headers if supported by your Wix plan.
  4. Alternatively, place your Wix site behind Cloudflare (update your domain's nameservers to Cloudflare) and add the X-Frame-Options header via Cloudflare Transform Rules as described in the BigCommerce steps.
  5. Contact Wix support to confirm the current platform capability for custom HTTP headers on your specific plan.
Full Wix guide →Official Wix docs ↗
How to fix missing x frame options on Wix Studio
  1. Wix Studio (formerly Editor X) also does not expose raw HTTP response header controls in the admin UI.
  2. Route your Wix Studio domain through Cloudflare: update your domain's nameservers to Cloudflare → in Cloudflare, go to Rules → Transform Rules → Response Header Modification → add X-Frame-Options: SAMEORIGIN for all requests.
  3. Alternatively, use Velo (Wix Code) in Wix Studio to add server-side logic where supported.
  4. Verify via browser DevTools after Cloudflare rule is active.
Full Wix Studio guide →Official Wix Studio docs ↗
How to fix missing x frame options on Squarespace
  1. Squarespace does not allow direct HTTP response header customization from the admin panel.
  2. Place your Squarespace site behind Cloudflare by pointing your domain's nameservers or DNS A/CNAME records to Cloudflare (in 'DNS only' mode if full proxy is preferred).
  3. In Cloudflare: Rules → Transform Rules → Response Header Modification → Add header: X-Frame-Options = SAMEORIGIN for all requests → Deploy.
  4. Verify by loading any Squarespace page and checking Response Headers in browser DevTools.
Full Squarespace guide →Official Squarespace docs ↗
How to fix missing x frame options on Webflow
  1. Webflow does not currently support setting arbitrary custom HTTP response headers from the Designer or project settings for standard hosted plans.
  2. For Webflow Enterprise: contact your Webflow account manager — Enterprise plans may support custom header configuration.
  3. For all Webflow plans: proxy your domain through Cloudflare → Rules → Transform Rules → Response Header Modification → Set X-Frame-Options = SAMEORIGIN → Save & Deploy.
  4. If you export your Webflow site and host it yourself (e.g., on Netlify or Vercel), add the header in netlify.toml or vercel.json — see the Headless / Custom entry.
  5. Verify with browser DevTools or securityheaders.com after the CDN rule or hosting config is live.
Full Webflow guide →Official Webflow docs ↗
How to fix missing x frame options on Adobe Commerce (Magento)
  1. In Adobe Commerce / Magento 2, go to Admin → Stores → Configuration → General → Web → Default Pages — note: this section does not directly set headers, but Magento has a built-in X-Frame-Options setting.
  2. Navigate to Admin → Stores → Configuration → General → Web → Default Pages (or search 'frame' in config search).
  3. Alternatively, set it directly in app/etc/env.php or via the Magento CLI: bin/magento config:set web/frame_options SAMEORIGIN
  4. For Apache-hosted Magento, add to your .htaccess in the Magento root: Header always set X-Frame-Options 'SAMEORIGIN' inside <IfModule mod_headers.c>.
  5. For Nginx-hosted Magento, add to your server block in the Nginx config: add_header X-Frame-Options 'SAMEORIGIN' always; — then reload Nginx: sudo nginx -s reload.
  6. Flush Magento cache: Admin → System → Cache Management → Flush Magento Cache, then verify in browser DevTools.
Full Adobe Commerce (Magento) guide →Official Adobe Commerce (Magento) docs ↗
How to fix missing x frame options on Magento Open Source
  1. Same steps as Adobe Commerce (Magento) above — the Magento 2 CLI command bin/magento config:set web/frame_options SAMEORIGIN applies to both editions.
  2. Also check your server-level config (Apache .htaccess or Nginx server block) as described above to ensure the header is sent at the web server layer as well.
Full Magento Open Source guide →Official Magento Open Source docs ↗
How to fix missing x frame options on PrestaShop
  1. In PrestaShop, the recommended approach is to add the header at the web server level or via an override.
  2. For Apache: edit your .htaccess file in the PrestaShop root and add inside <IfModule mod_headers.c>: Header always set X-Frame-Options 'SAMEORIGIN'.
  3. For Nginx: in your server block config, add: add_header X-Frame-Options 'SAMEORIGIN' always; then reload Nginx.
  4. Alternatively, install a PrestaShop security module from the marketplace (search 'security headers') that adds HTTP security headers.
  5. Verify by checking response headers in browser DevTools on your store's homepage and checkout page.
Full PrestaShop guide →Official PrestaShop docs ↗
How to fix missing x frame options on Headless / Custom (I build in code)
  1. For Next.js: add headers() to your next.config.js as shown in the code snippets below.
  2. For Nuxt.js: add headers via the render.bundleRenderer or use the nuxt-helmet module, or configure at the Nitro server level.
  3. For Express.js / Node: use the 'helmet' npm package (helmet() automatically sets X-Frame-Options: SAMEORIGIN) or manually: res.setHeader('X-Frame-Options', 'SAMEORIGIN');
  4. For Apache: in httpd.conf or .htaccess, add inside <IfModule mod_headers.c>: Header always set X-Frame-Options 'SAMEORIGIN'.
  5. For Nginx: in your server or location block: add_header X-Frame-Options 'SAMEORIGIN' always;
  6. For Netlify: add to netlify.toml. For Vercel: add to vercel.json. See code snippets below.
  7. For Cloudflare (any platform behind it): Rules → Transform Rules → Response Header Modification → Set X-Frame-Options = SAMEORIGIN → Deploy.
Full Headless / Custom (I build in code) guide →Official Headless / Custom (I build in code) docs ↗
How to fix missing x frame options on OpenCart
  1. For Apache-hosted OpenCart, edit the .htaccess file in the OpenCart root and add: <IfModule mod_headers.c> Header always set X-Frame-Options 'SAMEORIGIN' </IfModule>
  2. For Nginx-hosted OpenCart, add to your server block: add_header X-Frame-Options 'SAMEORIGIN' always; and reload Nginx.
  3. Alternatively, edit OpenCart's index.php or a system startup file to add: header('X-Frame-Options: SAMEORIGIN'); before any output.
  4. Verify with browser DevTools.
Full OpenCart guide →Official OpenCart docs ↗
How to fix missing x frame options on Cloudflare (CDN/Proxy)
  1. Log in to your Cloudflare dashboard and select your domain.
  2. Go to Rules → Transform Rules → Response Header Modification.
  3. Click Create Rule, give it a name like 'Add X-Frame-Options'.
  4. Set Field: Hostname, Operator: equals, Value: yourdomain.com (or use a wildcard).
  5. Under Then: Set Header → Header Name: X-Frame-Options, Value: SAMEORIGIN.
  6. Save and deploy. The header will be injected into all responses passing through Cloudflare.
Full Cloudflare (CDN/Proxy) guide →

Does your site have this issue?

Run a free SEOLZ scan to find missing x frame options — and every other issue — across your whole site in minutes.

Scan my site free

Frequently asked questions

What is Missing x frame options?

The X-Frame-Options header is a security instruction your web server sends to browsers telling them whether your pages are allowed to be loaded inside an iframe (an invisible "frame" embedded in another website). When this header is missing, any website in the world can silently embed your store inside their page. The two safe values are DENY (no framing at all) and SAMEORIGIN (only your own domain can frame your pages). Most stores should use SAMEORIGIN unless you have no legitimate need to embed your own pages in iframes, in which case DENY is even stronger.

Why does missing x frame options matter?

Without X-Frame-Options, attackers can use a technique called "clickjacking" — they overlay your store's checkout or login page inside an invisible iframe on a malicious site, tricking shoppers into clicking buttons they can't see. This can lead to unauthorized purchases, stolen account credentials, or fraudulent transactions, directly costing you revenue and eroding customer trust. Search engines and security scanners flag this missing header as a vulnerability under OWASP A05:2021 (Security Misconfiguration), which can affect your site's security rating and enterprise buyer trust. Many payment card industry (PCI DSS) compliance checklists also require it, so missing it can jeopardize your ability to process card payments.

How do I fix missing x frame options?

Add the X-Frame-Options HTTP response header set to DENY or SAMEORIGIN to prevent your store's pages from being embedded in iframes on other sites.

Authoritative references

Related Security (OWASP) issues