Missing X-Frame-Options protection

Why it matters

Neither X-Frame-Options nor a CSP frame-ancestors directive is present, so the site can be framed by other origins (a clickjacking risk).

What to do

Add the missing security header at the server/CDN level.

IT/Security · About 2 hours · Needs a specialist

How to fix it

1. Add the missing header at the web server, CDN, or platform configuration level (exact method depends on hosting).
2. Start with a permissive policy (e.g. CSP report-only mode) and tighten iteratively to avoid breaking functionality.
3. Re-test with a header-scanning tool after each change.