How to Fix: X-Frame-Options set

X-Frame-Options set is an important SEO check in the Security & Trust category. This is a medium-priority issue. While not urgent, fixing it will improve your overall SEO health.

What this check is really asking

This check verifies that your site sends the X-Frame-Options HTTP response header. That header does one specific job: it tells browsers whether your pages are allowed to be loaded inside a frame — an <iframe>, <frame>, or <object> — on someone else’s site. Without it, an attacker can embed your live site invisibly on a page they control and trick your users into clicking things they cannot see. That attack has a name: clickjacking.

When this check fails, your responses are simply missing the header, leaving your pages framable by anyone. The fix is genuinely a five-minute job — this is one of the highest security-return-per-effort items on the whole list.

Why a missing header is a real trust problem

• Clickjacking is a concrete attack, not a theoretical one — framed pages have been used to hijack clicks on login and payment actions
• Security scanners and browsers flag the absence, and those flags erode the trust signals search engines increasingly weigh
• It is table stakes for any site handling logins or checkout — a WooCommerce store with no frame protection looks careless to anyone who checks
• It is trivially cheap to add, so its absence reads as neglect rather than a considered trade-off

How to Fix This in WordPress

Difficulty Level: EASY – This fix is straightforward and can typically be completed by anyone with basic WordPress knowledge.

Estimated Time: 5 min

Step 1: Pick the value you want

There are two sensible settings. SAMEORIGIN allows only your own site to frame your pages — the right default for almost everyone, because it still lets your own embeds work. DENY forbids all framing, including your own. Use SAMEORIGIN unless you have a specific reason to lock it down completely.

Step 2: Add the header where your stack fits

Choose one method:

• Apache: add Header always set X-Frame-Options "SAMEORIGIN" to your .htaccess
• Nginx: add add_header X-Frame-Options "SAMEORIGIN" always; to the server block
• A security plugin: plugins that manage security headers can set it from the WordPress dashboard with no server access needed — the simplest route if you are not comfortable editing config files

Step 3: Consider the modern companion

X-Frame-Options is well supported and still worth setting, but the modern equivalent is the Content-Security-Policy frame-ancestors directive, which is more flexible and takes precedence in browsers that support both. If you are already configuring a CSP, set frame-ancestors 'self' there too. For this check, the X-Frame-Options header alone resolves it.

Step 4: Verify the fix

1. Load your site and inspect the response headers in your browser’s developer tools (Network tab) to confirm X-Frame-Options is present
2. Or run the site through a free security-headers scanner
3. Confirm any legitimate embeds of your own content still work
4. Clear your WordPress cache, re-run the SEO Roadmap audit, and check Google Search Console after a few days

Where this sits in a proper header set

While you are in there, do the job once and do it fully. X-Frame-Options is one of a small family of security headers that together take a few minutes and meaningfully harden a site — Strict-Transport-Security, X-Content-Type-Options: nosniff, a sane Referrer-Policy, and a Content-Security-Policy. I would not open the config file, set this one header, and close it again. Set the whole set in one sitting, test that nothing on the front end breaks, and you have cleared several security checks at once for barely more effort than clearing this one.

Common Mistakes to Avoid

• Setting DENY and then wondering why your own legitimate embeds stopped working — use SAMEORIGIN
• Adding the header in two places (server and plugin) so it is sent twice, which some browsers reject
• Setting it once and never re-checking after a host or server migration wipes the config
• Stopping at this one header when the full set was a few extra minutes away

Recommended Tools & Plugins

These tools can help you fix and prevent this issue:

• Yoast SEO – Comprehensive SEO plugin with built-in checks
• Rank Math – Feature-rich SEO plugin with detailed analysis
• Google Search Console – Free tool to monitor your site’s search presence
• SEO Roadmap – Complete SEO audit and action plan tool

This guide is part of the SEO Roadmap knowledge base – your complete resource for WordPress SEO optimization.