How to fix missing x frame options on PrestaShop

Steps for PrestaShop

1. In your PrestaShop hosting environment, open your .htaccess file (root of your PrestaShop installation) and add: Header always set X-Frame-Options SAMEORIGIN
2. If using Nginx, add to your server{} block: add_header X-Frame-Options SAMEORIGIN always;
3. Alternatively, install a security-headers module from the PrestaShop Marketplace (search 'security headers') which adds X-Frame-Options via a back-office toggle.
4. Clear PrestaShop cache: Advanced Parameters → Performance → Clear Cache.
5. Verify via DevTools → Network → Response Headers.

X-Frame-Options: SAMEORIGIN

# Apache (.htaccess or VirtualHost):
Header always set X-Frame-Options SAMEORIGIN

# Nginx (server block):
add_header X-Frame-Options SAMEORIGIN always;

# Defence-in-depth — also add via CSP:
Content-Security-Policy: frame-ancestors 'self';

What is missing x frame options?

The X-Frame-Options header is a security instruction your web server sends to browsers telling them whether your pages are allowed to be loaded inside an iframe (an embedded frame inside another webpage). When this header is missing, any website in the world can silently embed your store inside their own page. The two safe values are DENY (your pages can never be framed by anyone, including yourself) and SAMEORIGIN (only pages on your own domain can frame your pages). Most stores should use SAMEORIGIN unless they have no legitimate need for iframing their own content, in which case DENY is the stronger choice.

Without this header, attackers can load your store's checkout or login page invisibly inside a malicious site and trick your customers into clicking buttons or entering credentials they think are on a trusted page — a well-known attack called "clickjacking." This can lead to stolen customer credentials, fraudulent orders, and credit card theft, exposing your business to liability and reputational damage. Search engines and security scanners flag the missing header as a misconfiguration (OWASP A05:2021), which can hurt your trust signals and put you at risk of failing PCI-DSS compliance checks if you accept card payments. Adding this header is a low-effort, high-impact fix that closes this attack vector entirely in modern browsers.

See the complete Missing x frame options guide for every platform and the full background.