# Can other sites show your pages inside a frame?

By Mark Kashef, founder of Lockpick. Published 2026-10-08, updated 2026-10-08.

The framing check looks for frame-ancestors or X-Frame-Options, the settings that stop clickjacking. Here is what a missing one means and how to fix it.

The framing check looks for a setting that tells browsers which sites may show your pages inside a frame, either a frame-ancestors rule or the older X-Frame-Options header. Without one, any site can frame you.

## What does this check look at?

It looks at whether your pages tell browsers which sites may show them inside a frame. Framing is how clickjacking works. MDN describes it as an attacker tricking the user into interacting with a target site in a way they did not intend.

Pulse and Deep scans both run it.

## What does a result mean?

| What the report shows | What it means | What to do |
| --- | --- | --- |
| Pass | A frame-ancestors rule or a valid X-Frame-Options value is set. | Nothing. |
| Attention | Neither setting was seen. | Allow framing only by your own site, unless embedding is a feature. |
| Not tested | The page is not HTML, so the check does not apply. | Nothing to act on. |

No clickjacking attempt is made, so a missing setting does not prove a visitor can be tricked. Some sites are built to be embedded, such as widgets and booking pages. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

## How serious is a finding?

Treat this as a hardening gap. It makes an attacker’s job easier but gives them no path of its own, so fix it after anything more direct. Confidence starts low, because it is inferred from headers or declarations rather than shown directly. The report lists what to fix by how directly someone could use it, not by the severity label.

### What does a confirmed finding have to show?

| Part | For this check |
| --- | --- |
| Where it starts | Content or a frame an attacker can influence |
| The protection that should stop it | A browser protection header is missing or weak |
| What is reached | How browsers treat your pages |
| What follows | A hardening gap; no exploit was shown |

## Which standards does it relate to?

| Standard | Reference |
| --- | --- |
| OWASP Top Ten | `A02:2025` Security Misconfiguration |
| CWE | `CWE-1021` |
| ASVS | `v5.0.0-3.4.6` |

Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.

## Fix it with your AI

One header fixes it. Keep an allowlist if partners embed your pages on purpose.

:::fix-prompt any
Stop other websites from showing my pages inside a frame. Add Content-Security-Policy: frame-ancestors 'self' (merge it into my existing CSP if I have one) and X-Frame-Options: SAMEORIGIN for older browsers. If any page of mine is meant to be embedded elsewhere, list it and allow only those embedding sites for that page. Show me the header changes.
:::

## How to check

Say Atlas, our example app at `atlas.example`, sends no framing rule. The check flags it, and after the fix the next scan reads the frame-ancestors rule and passes.

The free [quick check](/check) covers this on your homepage with no account, and a Pulse scan from your account adds your scripts and public records. [Pulse or Deep](/docs/get-started/pulse-or-deep) explains the difference.

## Questions people ask

### Does a missing setting mean my site was clickjacked?

No. It means it could be framed. A real attack also needs a page where one click does something that matters, and a victim who visits the attacker page.

### Do I need both headers?

frame-ancestors is the modern one. X-Frame-Options helps older browsers, and setting both is common and harmless.

## Sources

- [Clickjacking](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Clickjacking), MDN Web Docs, read on 2026-10-07
- [How we rate findings](https://www.lockpick.app/docs/security/how-we-rate-findings), Lockpick docs, read on 2026-10-07