Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm building a website that's not security-critical in any way at all, so having somebody put a page in an <iframe> is not particularly dangerous to its users. However, as my website doesn't have script plugins that will be used anywhere else, is there any reason why I shouldn't just apply:

X-Frame-Options: Deny

to every page on my website? Is there any valid reason for any other website to embed mine? I've seen plenty of content-stealing ones and attempts to hijack user accounts, but never an actual good usage of frames that's not an explicit feature of the website.

share|improve this question
up vote 8 down vote accepted

Some folks get a fair amount of traffic by allowing themselves to be framed by social network sharing sites like StumbleUpon - if your page is at all likely to be shared, I'd avoid doing this, and handle instances of framing in another way.

Also, your site can already be sucked in and repurposed by benign services like Google Translate - and I believe an HTTP header like that won't prevent that kind of usage.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.