Add X-Frame-Options in Drupal 8 with the Security Kit Module

The X-Frame-Options HTTP header specifies whether your Drupal website can be displayed within other websites with the <frame>, <iframe>, <object>, or <embed> HTML tags. This improves Drupal security against clickjacking and related cyber attacks.

Below we’ll cover how to install the Security Kit module and enable X-Frames-Options.

Mozilla recommends using the superseding Content Security Policy frame-ancestors attribute instead.

Install Security Kit

1. Login to Drupal.
2. Install the Drupal module using the Security Kit download link.
3. Click Install at the bottom.
4. Click Configuration at the top.

X-Frames-Options

1. Under System, Click Security Kit settings.
2. Under Clickjacking, click X-Frame-Options Header for options.
3. Select an X-Frames-Options HTTP header:
   SAMEORIGIN – your website can be framed in the same webpage (default option)
   Disabled
   DENY – website cannot be displayed in a frame
   ALLOW-FROM – website can only be framed within URIs specified below; may not work in newer browsers.
4. At the bottom, click Save configuration.

Get high performance and security with our Managed Drupal Hosting.