---
title: "Add X-Frame-Options in Drupal 8 with the Security Kit Module"
description: "The X-Frame-Options HTTP header specifies whether your Drupal website can be displayed within other websites with the <frame>, <iframe>, <object>, or <embed> HTML tags. This..."
url: https://www.inmotionhosting.com/support/edu/drupal/x-frames-options-drupal-8-security-kit/
date: 2019-12-03
modified: 2023-09-14
author: "InMotion Hosting Contributor"
categories: ["Drupal"]
type: post
lang: en
---

# Add X-Frame-Options in Drupal 8 with the Security Kit Module

The X-Frame-Options HTTP header specifies whether your [Drupal website](https://www.inmotionhosting.com/support/edu/drupal/drupal-8-release/) can be displayed within other websites with the <frame>, <iframe>, <object>, or <embed> HTML tags. This improves Drupal security against clickjacking and related cyber attacks.

Below we’ll cover how to install the [Security Kit module](#install) and enable [X-Frames-Options](#x).

[Mozilla recommends](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options) using the superseding Content Security Policy `frame-ancestors` attribute instead.

## Install Security Kit

1. [Login to Drupal](https://www.inmotionhosting.com/support/edu/drupal/how-to-log-into-the-drupal-admin-dashboard/).
2. [Install the Drupal module](https://www.inmotionhosting.com/support/edu/drupal/install-2/#admin) using the [Security Kit download link](https://www.drupal.org/project/seckit).
3. Click **Install** at the bottom.
4. Click **Configuration** at the top.

## X-Frames-Options

1. Under *System*, Click **Security Kit settings**.
2. Under *Clickjacking*, click **X-Frame-Options Header** for options.
3. Select an X-Frames-Options HTTP header:**SAMEORIGIN** – your website can be framed in the same webpage (default option)**Disabled****DENY** – website cannot be displayed in a frame**ALLOW-FROM** – website can only be framed within URIs specified below; may not work in newer browsers.
4. At the bottom, click **Save configuration**.

![Configure an X-Frame-Options response header](https://support-mkt.cloud.imhwebdev.net/support/wp-content/uploads/2019/12/drupal-security-kit-x-frames-1024x446.png)*Enable X-Frames-Options if you’re not using Content Security Policy yet*

Get high performance and security with our [Managed Drupal Hosting](https://www.inmotionhosting.com/drupal-hosting).