No recognised frame-embedding protection was found
The fetched content response lacked recognised X-Frame-Options protection, and ShipReady did not detect a restrictive CSP frame-ancestors directive.
Why it matters
Frame-embedding controls are configuration choices that can limit which origins embed a page. Reviewing the observed headers helps confirm that the application has an intentional framing policy.
How ShipReady detects it
What it inspects
ShipReady reads normalized headers from a successfully fetched, readable, same-site content-serving 2xx final response. It reads X-Frame-Options and parses the enforcing Content-Security-Policy header when present.
What triggers a finding
The rule triggers when X-Frame-Options is not exactly DENY or SAMEORIGIN after case normalization and ShipReady does not find a non-empty frame-ancestors source list without a wildcard. default-src does not substitute for frame-ancestors.
What the evidence shows
The observed content response lacked ShipReady's recognised X-Frame-Options value and did not contain a scanner-recognised restrictive CSP frame-ancestors directive.
Limits of this check
ShipReady does not attempt to frame the page, test browser behavior, or perform a complete CSP interpretation. It checks the final fetched response rather than every route or redirect hop. A finding does not establish confirmed clickjacking exposure or that any site can successfully frame the page.
How to fix it
Choose an intentional framing policy
Decide whether the page should be embedded and by which origins. Configure X-Frame-Options as DENY or SAMEORIGIN where it fits the application, or use a deliberate restrictive CSP frame-ancestors policy when CSP provides the framing control.
Test permitted integrations
Test any intended embedding, payment, support, or partner integrations after deploying the chosen policy.
How to verify the change
Inspect deployed framing headers
Inspect final response headers for representative pages and test the intended embedding cases in supported browsers.
Expected: The response has the intended X-Frame-Options value or restrictive frame-ancestors policy, and approved embeds continue to work.