Security & HTTPS

Any website can display this site inside a frame

One of the 136 checks Lala SEO runs on every page of a site in a free audit.

How serious: Worth knowing. Small, or only matters in some cases. Read it and decide.
Score: Reported, but it does not lower your site's score.
Based on: Industry standard: Google does not document this one, so the check follows established practice.

What is wrong

Your website can be placed inside a frame on another website. This happens because you have not set an HTTP header called X-Frame-Options, which is a security instruction that tells browsers whether outside websites are allowed to embed your pages.

Why it costs you

If someone embeds your site in their frame, visitors might think they are on that other website instead of yours. They could be tricked into entering passwords or personal information, believing they are on a trusted site when they are actually on a malicious one. You also lose credit for traffic and visitor trust.

How to fix it

Add the X-Frame-Options header to your web server configuration or through your hosting control panel. Set it to `SAMEORIGIN` if you want to allow your own pages to frame each other, or `DENY` if you want to block framing entirely. If you use a CMS or website builder, check its security settings for a framing protection option. This is a one-time server-wide fix, not something you need to change on individual pages.

What the audit tests

The start page's response limits who may frame it: CSP frame-ancestors, or X-Frame-Options DENY/SAMEORIGIN

Check your site

Run a free audit of up to 300 pages. No card needed.

Start a free audit

Or check a single address with the free tool.

Other security & https checks

All 136 checks