Quick fix
Define CSP `frame-ancestors` with `'none'`, `'self'`, or an explicit allowlist.
What this finding means
SecuTest accepts CSP `frame-ancestors` or `X-Frame-Options: DENY/SAMEORIGIN`. CSP is the modern control; X-Frame-Options remains useful for older clients. The check does not prove that every page contains a sensitive action.
Associated attack or threat scenario
How the attack or failure scenario works
Clickjacking overlays or hides a trusted page inside an attacker-controlled frame. The victim believes they are clicking the attacker's interface but actually activates controls in the framed application, potentially changing settings, authorizing actions, or disclosing information.
Conditions and limitations
- The application can be embedded by an attacker-controlled origin.
- The victim is authenticated or otherwise has access to a meaningful action.
- The attacker can align deceptive content with the framed control and the application lacks additional confirmation defenses.
Why it matters
Step-by-step fix
Where to make the change
- The outermost component emitting the public HTTP response: CDN, reverse proxy, ingress, web server, or application middleware.
- Apply the control consistently to normal pages, redirects, error responses, and relevant subdomains.
Remediation procedure
- Define CSP `frame-ancestors` with `'none'`, `'self'`, or an explicit allowlist.
- Add `X-Frame-Options: DENY` or `SAMEORIGIN` for legacy compatibility when it matches the intended policy.
- Require re-authentication or explicit confirmation for high-impact actions.
- Test every legitimate embedding integration before enforcing a restrictive policy.
Commands and configuration examples
Replace example values with the hostname, selector, IP address, port, provider, or policy values shown in your SecuTest evidence. Review every example before production use.
Content-Security-Policy: frame-ancestors 'none'
add_header Content-Security-Policy "frame-ancestors 'none'" always;
add_header X-Frame-Options "DENY" always;
Header always set Content-Security-Policy "frame-ancestors 'none'"
Header always set X-Frame-Options "DENY"
Verify the fix
- Inspect CSP and X-Frame-Options on normal and error responses.
- Attempt to embed the page from an unrelated test origin and confirm the browser blocks it.
- Test authorized same-origin or partner framing where required.
- Verify that CSP is delivered as a response header, not only a meta element.
After DNS, CDN, certificate, mail, or application propagation completes, run a fresh SecuTest scan and compare the new evidence with the original finding.
Common mistakes
- Using `ALLOW-FROM`, which has poor browser support.
- Allowing all framing to support one partner instead of explicitly allowlisting it.
- Relying on JavaScript frame-busting code as the primary control.