Security Vulnerabilities Guide

Without this header, an attacker can embed your site in a transparent iframe on their malicious page. They overlay fake buttons on top of your site's real buttons. When users think they are clicking on the attacker's page, they are actually performing actions on your site (liking, purchasing, changing settings). This is called clickjacking.

Set X-Frame-Options to DENY (if your site doesn't need to be framed) or SAMEORIGIN (if you need self-framing). For more granular control, use the frame-ancestors directive in CSP.