How to fix missing x frame options on Webflow

Steps for Webflow

1. In your Webflow project, go to Project Settings → Security (or the 'Hosting' tab, depending on your plan) — Webflow allows you to add custom HTTP response headers for sites on the paid hosting plans.
2. Under 'Custom Response Headers', click Add Header, enter Name: X-Frame-Options, Value: SAMEORIGIN, and save.
3. Publish your site for the change to take effect.
4. Verify via DevTools → Network → Response Headers on any published page.
5. If you host Webflow via a custom server/export, add the header in your Nginx or Apache config as described in the WooCommerce steps above.

X-Frame-Options: SAMEORIGIN

# Apache (.htaccess or VirtualHost):
Header always set X-Frame-Options SAMEORIGIN

# Nginx (server block):
add_header X-Frame-Options SAMEORIGIN always;

# Defence-in-depth — also add via CSP:
Content-Security-Policy: frame-ancestors 'self';

What is missing x frame options?

The X-Frame-Options header is a security instruction your web server sends to browsers telling them whether your pages are allowed to be loaded inside an iframe (an embedded frame inside another webpage). When this header is missing, any website in the world can silently embed your store inside their own page. The two safe values are DENY (your pages can never be framed by anyone, including yourself) and SAMEORIGIN (only pages on your own domain can frame your pages). Most stores should use SAMEORIGIN unless they have no legitimate need for iframing their own content, in which case DENY is the stronger choice.

Without this header, attackers can load your store's checkout or login page invisibly inside a malicious site and trick your customers into clicking buttons or entering credentials they think are on a trusted page — a well-known attack called "clickjacking." This can lead to stolen customer credentials, fraudulent orders, and credit card theft, exposing your business to liability and reputational damage. Search engines and security scanners flag the missing header as a misconfiguration (OWASP A05:2021), which can hurt your trust signals and put you at risk of failing PCI-DSS compliance checks if you accept card payments. Adding this header is a low-effort, high-impact fix that closes this attack vector entirely in modern browsers.

See the complete Missing x frame options guide for every platform and the full background.