{"id":"ia.frame-protection","name":"X-Frame-Options / frame-ancestors","verify":{"command":"curl -sI https://{domain}/","rescan":"isagentready results {domain} --checkpoint ia.frame-protection","expect":"X-Frame-Options or a Content-Security-Policy with frame-ancestors"},"fix":{"steps":[{"action":"Add frame-ancestors to the Content-Security-Policy, or send X-Frame-Options.","order":1,"language":"nginx","code_example":"add_header Content-Security-Policy \"frame-ancestors 'self'\" always;"}],"summary":"Send X-Frame-Options or a CSP frame-ancestors directive.","skill":{"name":"security-trust","anchor":"ia.frame-protection"}},"category":"security","aggregate":null,"references":[{"title":"MDN: X-Frame-Options","kind":"guide","url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options"},{"title":"MDN: Content Security Policy","kind":"guide","url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP"}],"stage":"read","lifecycle":{"introduced":"2026-08-24","revised":[],"retired":null,"replaced_by":null},"methodology_version":"2026-10-22","evidence_tier":"standard","evidence_source":{"title":"MDN: X-Frame-Options","url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options"},"why":"Frame protection prevents your site from being embedded in malicious iframes (clickjacking). This protects users who interact with your site through AI-suggested links.","profiles":["browser_agent_usability","api_tool_readiness","agentic_commerce"],"score_role":"core","legacy_id":"5.6","i18n":{"nl":{"name":"X-Frame-Options / frame-ancestors","steps":["Voeg frame-ancestors toe aan de Content-Security-Policy, of stuur X-Frame-Options."],"why":"Frame-bescherming voorkomt dat je site in kwaadaardige iframes wordt geladen (clickjacking). Dit beschermt gebruikers die via AI-links op je site komen.","fix_summary":"Stuur X-Frame-Options of een CSP-frame-ancestors-richtlijn.","verify_expect":"X-Frame-Options of een Content-Security-Policy met frame-ancestors"}},"ar_practice_ids":[],"strength":"MUST","ar_mapping":"none","evidence_type":"recommendation","detail_url":"https://isagentready.com/en/methodology/checkpoints/ia.frame-protection","maturity":"essential","applicability":{"mode":"always","condition":null,"surfaces":["website"]}}