How to fix missing x frame options on Adobe Commerce (Magento)

Steps for Adobe Commerce (Magento)

1. In the Magento Admin Panel, go to Stores → Configuration → General → Web → Default Pages — check if a built-in X-Frame-Options setting exists (Magento 2.x exposes this under Stores → Configuration → Security).
2. For Magento 2.x: go to Stores → Configuration → Security → set 'X-Frame-Options Header' to SAMEORIGIN and save.
3. Alternatively, open your Nginx server block config (typically /etc/nginx/sites-available/your-store.conf) and add inside the server{} block: add_header X-Frame-Options SAMEORIGIN always; Then reload Nginx: sudo nginx -s reload
4. For Apache: open your .htaccess or VirtualHost config and add: Header always set X-Frame-Options SAMEORIGIN Then restart Apache.
5. Flush the Magento full-page cache: System → Cache Management → Flush Cache Storage.
6. Verify via DevTools → Network → Response Headers.

X-Frame-Options: SAMEORIGIN

# Apache (.htaccess or VirtualHost):
Header always set X-Frame-Options SAMEORIGIN

# Nginx (server block):
add_header X-Frame-Options SAMEORIGIN always;

# Defence-in-depth — also add via CSP:
Content-Security-Policy: frame-ancestors 'self';

What is missing x frame options?

The X-Frame-Options header is a security instruction your web server sends to browsers telling them whether your pages are allowed to be loaded inside an iframe (an embedded frame inside another webpage). When this header is missing, any website in the world can silently embed your store inside their own page. The two safe values are DENY (your pages can never be framed by anyone, including yourself) and SAMEORIGIN (only pages on your own domain can frame your pages). Most stores should use SAMEORIGIN unless they have no legitimate need for iframing their own content, in which case DENY is the stronger choice.

Without this header, attackers can load your store's checkout or login page invisibly inside a malicious site and trick your customers into clicking buttons or entering credentials they think are on a trusted page — a well-known attack called "clickjacking." This can lead to stolen customer credentials, fraudulent orders, and credit card theft, exposing your business to liability and reputational damage. Search engines and security scanners flag the missing header as a misconfiguration (OWASP A05:2021), which can hurt your trust signals and put you at risk of failing PCI-DSS compliance checks if you accept card payments. Adding this header is a low-effort, high-impact fix that closes this attack vector entirely in modern browsers.

See the complete Missing x frame options guide for every platform and the full background.