How to Secure Nginx from Clickjacking with X-FRAME-OPTIONS for wordpress

Clickjacking is a well-known web application vulnerabilities.

A lot of wordpress developer tend to forget securing their wordpress site, now this is one of the many ways on how to secure your website.

So here you go…

The X-Frame-Options in HTTP response header can be used to indicate whether or not a browser should be allowed to open a page in frame or iframe.

This will prevent site content embedded into other sites.

Did you every try embed Google.com on your website as a frame? You can’t because it’s protected and you can protect it too.

There are three settings for X-Frame-Options:

1. SAMEORIGIN: This setting will allow the page to be displayed in a frame on the same origin as the page itself.
2. DENY: This setting will prevent a page displaying in a frame or iframe.
3. ALLOW-FROM URI: This setting will allow a page to be displayed only on the specified origin.

Implementation

• Go to where Nginx is installed and then a conf folder
• Take a backup before modifying
• Add the following parameter in nginx.conf under server section

add_header X-Frame-Options "SAMEORIGIN";

If you are using WHM cPanel, its ideal to install Engintron (NGINX) and navigate at the nginx.conf like in the screenshot below;

Dont forget to Restart Nginx webserver

Verification

You can use a web developer tool in the browser to view Response headers. It should look like this below:

Verification

You can use a web developer tool in the browser to view Response headers. It should look like this.

Alternatively, you can also use HTTP Header online tool to verify this.

I hope this helps. For more on security, check out my Nginx Hardening & Security guide.

This is just one of the hundreds of security fixes for a website. If you are looking for a complete security solution, you may consider cloud-based security providers like SUCURI, or Bunny.net CDN.

Lightning fast and secure CDN with severs all around the globe! Choose the most suitable package for your business at affordable price! Fastest Global Storage.