Readiness check · Harden lane · weight 4

Framing restricted

Cloudflare: Add the header with a response header transform rule.
Amazon CloudFront: Set frame options in a response headers policy.
Next.js: Add it in next.config.js headers().

The homepage sends X-Frame-Options or a Content-Security-Policy with frame-ancestors.

Why it matters

Without it, another site can load your pages in a hidden frame and trick visitors into clicking buttons (clickjacking).

Send Content-Security-Policy: frame-ancestors 'self' (or a list of trusted origins). X-Frame-Options: SAMEORIGIN covers older browsers.

The homepage sends X-Frame-Options or a Content-Security-Policy with frame-ancestors.

Observed: Framing controls present.

Not observed: No framing control found.

Limit: Read from the homepage response only; other pages or regions may send different headers.