Widely Available Security

X-Frame-Options

The X-Frame-Options HTTP header limits where a document may be embedded in an iframe. The X-Frame-Options: SAMEORIGIN header disallows embedding in another origin. The X-Frame-Options: DENY header disallows embedding in any context, regardless of origin.

Baseline Status: Achieved Widely Available on Jan 29, 2018 (Cross-browser Newly Available since Jul 29, 2015).

Desktop Browser Engine Support

Google Chrome

4

Supported

Mozilla Firefox

4

Supported

Apple Safari

4

Supported

Microsoft Edge

12

Supported

Mobile Browser Engine Support

Chrome Android

18

Firefox Android

4

Safari iOS

3.2

Specifications and References

Specification ↗ Feature XML ↗

MDN Browser Compat Data Keys:

http.headers.X-Frame-Options ↗ http.headers.X-Frame-Options.DENY ↗ http.headers.X-Frame-Options.SAMEORIGIN ↗