Skip to content
Raptor home
Menu

Missing X-Frame-Options

security.missing_x_frame_options
Priority
Note
Severity
Info

What we look for

These pages are served without an X-Frame-Options header (a rule telling browsers whether other sites may show the page inside a frame).

Why it matters

Without it, another site could show your page inside its own and trick visitors into clicking things they cannot see. It protects visitors but does not affect search results, so it costs no points.

How to fix

Add X-Frame-Options: SAMEORIGIN (or DENY) in your server, CDN or hosting settings, unless other sites need to embed your pages.

What it cannot know

A Content-Security-Policy frame-ancestors rule does the same job, but Raptor does not read it.

Seen in a real crawl

From a crawl of Millbrook Hardware (the broken fixture), a test site from Raptor’s fixture suite.

Note

16 pages have no X-Frame-Options header

  • /Missing X-Frame-Options header
  • /goneMissing X-Frame-Options header
  • /missingMissing X-Frame-Options header
First 3 of 16 addressesPaths on http://127.0.0.1:8001raptor 0.3.0, 17 Oct 2026

Open this finding in that crawl’s report

It also fired on Kestrel Bay Digital and the js-heavy fixture.

Where you’ll see it

The id is stable, and every surface uses it, so it’s the thing to search for or hand to an agent.

Terminal
When it is one of the five findings under Fix first, raptor crawl prints the id under it.
Check: security.missing_x_frame_options
crawl.json and the CSV
The crawl JSON names the finding by this id, and so do the CSV and raptor_query.
"check_id": "security.missing_x_frame_options"
The HTML report
This link opens the finding in the report, and each finding shows its id.
crawl.html#finding=security.missing_x_frame_options
MCP
raptor_findings with this check_id returns the finding in full, with a fix brief ready to paste into a task. If it didn’t fire, it says why.
raptor_findings {
  "job_id": "...",
  "check_id": "security.missing_x_frame_options"
}