SecurityUsually medium

Clickjacking checker: X-Frame-Options and frame-ancestors

If any website can load yours in an invisible frame, it can trick your visitors into clicking things they can't see. ShipPatrol checks for the headers that stop it.

Why it matters

Clickjacking is old and still works on sites without frame protection: a hidden "Delete account" or "Confirm payment" button under a fake "Play" button. One header fixes it.

How Patch checks

We check your homepage for a Content-Security-Policy frame-ancestors directive or an X-Frame-Options header.

How to fix it

Add frame-ancestors 'self' to your Content-Security-Policy, or send X-Frame-Options: SAMEORIGIN.
If another site of yours needs to embed this one, list it in frame-ancestors instead of 'self'.

Your own report goes further: it names the exact pages, services and settings Patch found on your site, and with a full report you get a fix prompt to paste into Lovable, Bolt or Cursor.

Where this applies

Good security practice everywhere.

Free scan

Check this on your site.

Patch runs "Site can be embedded by other websites" along with every other check, from the UK, the EU and the US. Free, no signup.

All checks