framing blocked

Every web page can, in theory, be loaded inside a box on another web page. That box is called a frame. It is how a YouTube video appears on a blog, and how a map sits on a contact page. Useful, most of the time.

The problem is that the same trick works on your whole site. Someone can put up a page that looks like theirs, load your real site inside an invisible frame, and lay their own buttons over the top. A visitor thinks they are clicking “Book now” on your page. They are actually clicking something else. The name for that attack is clickjacking, and it is old, cheap, and still works against sites that have not switched it off.

Framing blocked is the switch. Every page your site sends carries a short instruction to the browser: do not display this inside another site’s frame. Browsers honour it. The embed fails, the fake page shows an empty box, and the trick is over before it starts.

Why it matters to you

Your site is where people trust you enough to hand over a phone number, an address, or a card. Anything that lets a stranger borrow that trust is a risk with your name on it. Framing blocked closes one of the simplest ways to do that, and it costs nothing to run.

It also matters for the boring reason that security scanners check for it. Insurance questionnaires, procurement forms, and the automated tools a bigger client’s IT department runs will flag a site that allows framing. Having it on means one less awkward question.

How I set it up

I do not install a plugin for it. On the sites I build, the instruction is one of a small set of security headers that ship with every response from the hosting. It is written once in the site’s configuration, deployed with the code, and applies to every page automatically, including pages that do not exist yet. There is nothing to remember and nothing that can quietly switch itself off during an update.

The setting is strict by default: no framing by anyone. If a client ever needs a specific page to appear inside a partner’s portal, I can allow that one address and nothing else. That has come up once. Most businesses never need it.

What it looks like in practice

You will not see it. Your visitors will not see it. If you open your site’s address in a browser’s developer tools and look at the response headers, you will find a line that says the page may not be framed. That line is the whole feature.

What you will see, if you ever go looking, is a clean result on any security scan that checks for clickjacking protection. That is the point.