The fix, in one snippet
1. chrome://settings/help (or Menu > Help > About Firefox)
and restart if an update is waiting
2. chrome://extensions (about:addons in Firefox) and disable
anything that modifies headers or requests
3. Re-run this check with the extension disabledIllustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The scan page inserts three hidden iframes pointing at Scan.now probe endpoints. The first responds with X-Frame-Options: DENY, the second with X-Frame-Options: SAMEORIGIN from a different origin, the third with Content-Security-Policy: frame-ancestors 'none'. Each framed page, if it renders, posts a message to the parent with postMessage(). If the parent receives any of those messages within the timeout, the browser ignored the header and the check fails. If all three frames stay blank, it passes.
Limits: the check cannot tell a browser bug from an extension or proxy that strips response headers; a "disable X-Frame-Options" developer extension left switched on will fail this check, and so will a corporate proxy that rewrites headers before they reach the browser.
Why it matters
Clickjacking loads a target site invisibly inside an attacker's page and lines up a real button (transfer, delete, authorise) under something you want to click. X-Frame-Options and CSP frame-ancestors are the site's instruction to the browser not to allow that framing. When the browser does not enforce them, every site's defence is void at once, and the site owner cannot detect it. The people affected are those running header-modifying extensions (CORS unblockers, framing bypass tools), some embedded web views, and users of very old browsers.
How to fix it
Update the browser. Then review extensions that can modify response headers: on Chrome and Edge open chrome://extensions, on Firefox about:addons, and disable anything that advertises header editing, CORS unblocking or "ignore X-Frame-Options". Rerun the scan in a private window with extensions off (Chrome's Incognito disables extensions by default; Firefox has Troubleshoot Mode). If the failure persists only on a work network, ask whether a proxy rewrites headers. Site owners should send both headers; frame-ancestors takes precedence where supported:
X-Frame-Options: DENY
Content-Security-Policy: frame-ancestors 'none'See the website-side clickjacking check, clickjacking explained and HTTP security headers explained.
Where this fits
Browser enforces X-Frame-Options is check 5 of 16 that the browser security & privacy check runs under browser privacy and policy enforcement, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Browser enforces X-Content-Type-Options (medium), where your browser executed a script that was served with a non-script content type and X-Content-Type-Options: Nosniff, so it is guessing file types where it should refuse. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Browser enforces X-Frame-Options closes one route in. Immediately below it: Browser fingerprint uniqueness, where the combination of signals your browser exposes matched no other visitor in our sample, so it could be used to recognise you across sites without cookies; Third-party cookies allowed, where your browser accepts cookies set by third-party domains embedded in other sites, which is the basic mechanism of cross-site tracking; Browser defaults cookies to SameSite=Lax, where your browser sent a cookie that has no SameSite attribute on a cross-site request, so it does not apply the Lax default that limits cross-site request forgery.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Browser enforces X-Frame-Options (medium severity)
Scanner check id: xfo-enforcement
What this check tests: Your browser displayed a page inside a frame even though that page was served with X-Frame-Options: DENY, so the clickjacking protection sites rely on is not being enforced.The rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
8 min read · Updated Sep 14, 2026
Clickjacking Explained: How Invisible Frames Hijack Clicks and How to Prevent It
Clickjacking loads your site invisibly inside an attacker's page and tricks users into clicking buttons they cannot see. The attack,...
Read the guide
9 min read · Updated Sep 15, 2026
HTTP Security Headers Explained: Every Header, What It Blocks and How to Set It
Security headers are instructions a server sends the browser to switch on protections: Framing, MIME sniffing, referrer leakage, script...
Read the guide