Skip to content

Content Security Policy is missing the frame-ancestors directive

The observed Content-Security-Policy does not include frame-ancestors, the directive controlling which parent pages may embed a response. Review the actual X-Frame-Options response separately; it may already restrict framing. Other audit tools often report this finding as "Content-Security-Policy frame-ancestors missing".

Why this matters

Missing this directive alone does not prove exploitable clickjacking. Its policy must match intended embedding journeys. It has no default-src fallback and is not supported in an HTML meta element.

How to fix it

Inventory intended parent origins, then extend the delivered CSP response header with frame-ancestors 'none', 'self' or the approved parent origins as appropriate. Preserve the rest of the CSP. Test legitimate embeds and a controlled unapproved parent through the production delivery path. Review redirects, nested parent frames and existing X-Frame-Options behaviour before reporting the result.

Turn website findings into an action plan

Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.

Start Full Audit