Fix missing frame-ancestors without breaking embeds

What this directive controls

frame-ancestors controls which parent pages may embed the protected page. It differs from frame-src, which controls frames loaded by your page. It does not inherit a default-src policy, and it is not supported in a meta element. Configure it in the HTTP Content-Security-Policy response header.

Choose the intended embedding policy

If no page should embed this response, use none. For same-origin embedding, use self. If a trusted portal must embed it, list its exact approved origins. Include every ancestor required by a nested embedding arrangement. Inventory the actual pages and environments first; a service homepage and an embedded account view may need different policies.

# No embedding
Content-Security-Policy: frame-ancestors 'none'

# Same origin and one approved parent
Content-Security-Policy: frame-ancestors 'self' https://portal.example.com

1. List legitimate embedding journeys and their parent origins.
2. Confirm whether the rule is global or applies only to particular responses.
3. Review the existing CSP and X-Frame-Options configuration.
4. Agree the allowed parents with the application owner.

Extend the existing header safely

The examples isolate the directive for explanation. Do not replace a full production CSP with a frame-ancestors-only header and accidentally remove the other protections. Find the system that owns the delivered header: application, reverse proxy, hosting configuration or CDN. Review the final response instead of assuming a change to one layer is the whole policy.

Test permitted and denied parent pages

Verify behaviour from a real allowed parent and a controlled unapproved parent. Check browser console messages when an intended embed fails. A successful top-level page load does not test framing protection. Record the URL and response headers used by the browser, including any redirects to a different final response.

1. Confirm the delivered page has the intended frame-ancestors directive.
2. Exercise each legitimate embed through the production delivery path.
3. Check that a controlled unapproved parent cannot frame the protected page.
4. Retest sign-in, checkout or portal journeys that depend on embedding.

How to interpret X-Frame-Options

X-Frame-Options can already restrict framing, so missing frame-ancestors alone does not establish an exploitable clickjacking issue. Review the effective response and browser behaviour. Treat the change as a policy improvement with a tested compatibility result, rather than claiming that adding a header proves the application secure. A website scan can observe headers; it cannot exercise every authenticated user action or embedded workflow.

Frequently asked questions

See where your website stands

Start with a public-signal screening report in about 60 seconds. No signup or card. Quick Scan samples the website; it does not test every topic in this guide.