Methodology
X-Frame-Options / frame-ancestors
ia.frame-protection · 5.6
Read
MUST
Recommendation
Why it matters
Frame protection prevents your site from being embedded in malicious iframes (clickjacking). This protects users who interact with your site through AI-suggested links.
How to fix it
Send X-Frame-Options or a CSP frame-ancestors directive.
-
Add frame-ancestors to the Content-Security-Policy, or send X-Frame-Options.
add_header Content-Security-Policy "frame-ancestors 'self'" always;
Verify
curl -sI https://{domain}/
Expected: X-Frame-Options or a Content-Security-Policy with frame-ancestors
Run a new scan for this checkpoint:
isagentready results {domain} --checkpoint ia.frame-protection
Details Mapping, lifecycle and references
- AR mapping
- No AR practice
- Evidence source
- MDN: X-Frame-Options
- Score role
- Core
- Introduced
- 2026-08-24
- Methodology version
- 2026-10-22