Audit rules

Framing Protection Missing

The response has neither an X-Frame-Options header nor a Content-Security-Policy header with a frame-ancestors directive, so any site can embed the page in a frame. In a QuikSEO audit, a failure has info severity and counts against the score. The exact condition, its exceptions and its sources follow below.

01 — Definition

How This Rule Is Checked

The rule is a pure function of the fetched page: no extra requests, no account settings. The same input always gives the same result.

Rule Severity and Score

Rule id: security.frame_protection
Group: Security
Severity of a failure: Info
Counts in the score: Yes, whenever it applies to the page
Required for a score: No

Condition and Exceptions

Condition: Neither X-Frame-Options (DENY or SAMEORIGIN) nor frame-ancestors in a Content-Security-Policy header → fail (info)
Exceptions: frame-ancestors in a <meta> policy does not count (CSP3 ignores it there) and is named in the evidence; HTML mode → not_checked

Sources and Project Decision

Sources: HTML Standard, section 7.7: The X-Frame-Options header (WHATWG, Q58)
Content Security Policy Level 3 (W3C Working Draft), section 3.3: The meta element (W3C, Q84)
WHATWG HTML: the X-Frame-Options header (WHATWG, Q09)
W3C Content Security Policy Level 3: frame-ancestors (not supported in a meta element policy) (W3C, Q10)
Project decision: Info (lot 2). Only response headers count: CSP Level 3 ignores frame-ancestors in a <meta> policy (Q10), so a meta policy is named in the evidence but does not protect the page.

02 — Security

Other Rules in This Group

The other checks of the same group, each with its own condition and sources.

X-Content-Type-Options Missingsecurity.content_type_options
Content Security Policy Missingsecurity.csp
HSTS Missingsecurity.hsts
Permissions Policy Missingsecurity.permissions_policy
Referrer Policy Missingsecurity.referrer_policy
Flagged by Safe Browsingsecurity.safe_browsing
Form Submits Over HTTPsecurity.unsafe_forms