What it reads
The X-Frame-Options header, or frame-ancestors in your Content-Security-Policy. Either passes when browsers act on it: DENY or SAMEORIGIN, or frame-ancestors limited to 'none', 'self' or named sites.
Check 25 of 54 · Web and TLS
Clickjacking, explained.
Your site cannot be hidden inside a malicious page to trick people into clicking.
Engine 1.57.0, read 25 October 2026
Free checkScoredReliability: Definitive
Is your website set up safely?
What the check does, and where it stops.
Why it matters
Without it, an attacker can lay your page invisibly over theirs and borrow your visitor's clicks.
What a failure looks like
A failure is a finding in your result. The check is scored, so it can lower your score, and the Full Report gives every finding its severity and a fix. If the check cannot finish, it is recorded as unknown: it carries no penalty, and it is never a pass.
Where its limits are
None.
ReliabilityDefinitive: reads a published value
Check 25 is one of 15 in Web and TLS. See it in its row on the scanner page, beside the rest of Web and TLS.
See how your domain does.
The free check includes this one and takes about 30 seconds. No account. Nothing to install.