Pages send no framing headers

Why it matters

web.dev's security headers reference recommends X-Frame-Options for all documents that are not designed to be embedded, and the frame-ancestors directive of a Content Security Policy for finer control over who may frame a page.

What to do

1. Look at the finding: it shows the page's X-Frame-Options and CSP headers as we read them.
2. Add frame-ancestors 'self' to your Content-Security-Policy header, or 'none' if the page is never framed, or send X-Frame-Options: SAMEORIGIN or DENY.
3. Send it as a response header: a frame-ancestors in a <meta> tag does not count.

When to leave it as it is: if the page is meant to be embedded on other sites, such as a widget, you can leave it.

What we read

We read the final response headers of each crawled page with our own user agent, and its HTML without running JavaScript. Only indexable HTML pages that answered 200 are judged: pages with noindex, or with a canonical to another address, are not reported.

A page is reported when its response has no X-Frame-Options header at all and no Content-Security-Policy header with a frame-ancestors directive. Any X-Frame-Options value clears it, even an invalid one, and so does any frame-ancestors value, even *. A frame-ancestors in a <meta> tag is recorded but does not count. Pages whose headers or HTML were not captured in full are not judged.

Example & evidence

Illustrative example — one response, not a live audit.

https://bakery.example/account/ answers 200 with:

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Security-Policy: default-src 'self'

There is no X-Frame-Options header and the policy has no frame-ancestors, so the page is reported.

Content-Security-Policy: default-src 'self'; frame-ancestors 'self'

A possible correction: the same policy with frame-ancestors 'self' added.

Confirm & check again

Check for yourself: open the page's response headers in your browser's developer tools and look for X-Frame-Options, and for frame-ancestors in Content-Security-Policy.

Check again: Full audit — run a new audit of the site. The finding closes when the page is crawled again with complete headers and HTML and has either header. It also closes if the page becomes noindex or names another page as canonical, without any header change. A page that is not crawled again, or answers 404, keeps the finding open.

Limits & sources

The check sees whether a header is present, not whether it protects: an empty or invalid X-Frame-Options, or frame-ancestors *, clears it. Framing is not tried in a browser, and only the final response each page gave our crawler is read.

Confidence: High because the headers are read directly from the response.

Sources

• web.dev, Security headers quick reference — recommends X-Frame-Options for all documents that are not designed to be embedded, and the CSP frame-ancestors directive for finer control. Checked 28 September 2026.

Editorial review: 2 November 2026

Related

• X-Frame-Options conflicts with frame-ancestors or is invalid alongside it — both framing headers are present but describe different rules.
• Pages have no Content Security Policy — the page sends no Content Security Policy at all; this separate check is currently deferred in the audit.