How to fix missing x frame options on Headless / Custom (I build in code)

Add the X-Frame-Options HTTP response header set to DENY or SAMEORIGIN to prevent your store's pages from being embedded in iframes on other sites.

Steps for Headless / Custom (I build in code)

  1. For Next.js: add headers() to your next.config.js as shown in the code snippets below.
  2. For Nuxt.js: add headers via the render.bundleRenderer or use the nuxt-helmet module, or configure at the Nitro server level.
  3. For Express.js / Node: use the 'helmet' npm package (helmet() automatically sets X-Frame-Options: SAMEORIGIN) or manually: res.setHeader('X-Frame-Options', 'SAMEORIGIN');
  4. For Apache: in httpd.conf or .htaccess, add inside <IfModule mod_headers.c>: Header always set X-Frame-Options 'SAMEORIGIN'.
  5. For Nginx: in your server or location block: add_header X-Frame-Options 'SAMEORIGIN' always;
  6. For Netlify: add to netlify.toml. For Vercel: add to vercel.json. See code snippets below.
  7. For Cloudflare (any platform behind it): Rules → Transform Rules → Response Header Modification → Set X-Frame-Options = SAMEORIGIN → Deploy.
Official Headless / Custom (I build in code) documentation ↗

What is missing x frame options?

The X-Frame-Options header is a security instruction your web server sends to browsers telling them whether your pages are allowed to be loaded inside an iframe (an invisible "frame" embedded in another website). When this header is missing, any website in the world can silently embed your store inside their page. The two safe values are DENY (no framing at all) and SAMEORIGIN (only your own domain can frame your pages). Most stores should use SAMEORIGIN unless you have no legitimate need to embed your own pages in iframes, in which case DENY is even stronger.

Without X-Frame-Options, attackers can use a technique called "clickjacking" — they overlay your store's checkout or login page inside an invisible iframe on a malicious site, tricking shoppers into clicking buttons they can't see. This can lead to unauthorized purchases, stolen account credentials, or fraudulent transactions, directly costing you revenue and eroding customer trust. Search engines and security scanners flag this missing header as a vulnerability under OWASP A05:2021 (Security Misconfiguration), which can affect your site's security rating and enterprise buyer trust. Many payment card industry (PCI DSS) compliance checklists also require it, so missing it can jeopardize your ability to process card payments.

See the complete Missing x frame options guide for every platform and the full background.

Not sure if your Headless / Custom (I build in code) store has this?

Run a free SEOLZ scan — we’ll find missing x frame options and every other issue across your whole site.

Scan my site free

Fix missing x frame options on another platform