Frame protection missing

Markdown-backed fix guides for Amhost Labs audit findings.

What is it?

This HTTP header finding means the response does not include a frame embedding control such as CSP frame-ancestors or legacy X-Frame-Options.

Why does it matter?

Frame protection reduces clickjacking risk. Without it, another site may be able to embed your page in an iframe and trick users into interacting with hidden or misleading UI.

How to fix it?

Prefer CSP frame-ancestors because it is more flexible and applies to modern browsers.

Content-Security-Policy: frame-ancestors 'self'

For legacy compatibility, you can also add:

X-Frame-Options: SAMEORIGIN

Use DENY or frame-ancestors 'none' for pages that should never be embedded.