How to fix x frame options weak on Wix
Change the X-Frame-Options response header from its current weak or missing value to either DENY or SAMEORIGIN so your store cannot be embedded in a malicious iframe.
Steps for Wix
- Wix does not provide direct HTTP response header control for standard sites.
- Wix sets its own X-Frame-Options policy on the platform; verify what is currently sent using DevTools or securityheaders.com on your live Wix domain.
- If the header is missing or weak, submit a support request to Wix to ask about their security header policy — this is an infrastructure-level setting for standard Wix.
- Wix Studio / Velo advanced sites: you can add custom HTTP headers via Wix's HTTP functions (wix-http-functions) for specific API routes, but full page response headers remain platform-controlled.
- For maximum control, consider routing traffic through Cloudflare (add your Wix site's DNS to Cloudflare, proxied) and use Cloudflare Transform Rules to inject X-Frame-Options: DENY on all responses.
X-Frame-Options: DENYWhat is x frame options weak?
The X-Frame-Options HTTP header is a one-line instruction your web server sends to every visitor's browser telling it whether your store's pages are allowed to be loaded inside an iframe (a "page within a page") on another website. There are two safe values: DENY (no site, including your own, can frame your pages) and SAMEORIGIN (only pages on your own domain can frame them). A weak or absent value means any website on the internet can load your store inside an invisible or disguised iframe — a classic attack called clickjacking.
Clickjacking lets attackers overlay your real checkout or login page inside a transparent iframe on a fake site, tricking customers into clicking buttons they can't see — handing over payment details, credentials, or completing purchases they didn't intend. This is a direct revenue, fraud, and brand-trust risk. It also violates PCI-DSS requirements around protecting cardholder data environments and can expose you to legal liability if customers are defrauded through your site. Google's Safe Browsing program can flag sites involved in such abuse, which destroys organic search rankings overnight.
See the complete X frame options weak guide for every platform and the full background.
Not sure if your Wix store has this?
Run a free SEOLZ audit — we’ll find x frame options weak and every other issue across your whole site.
Scan my site free