---
title: "X-Frame protection"
slug: "x-frame-protection"
description: "By enabling the X-Frame options in Document360, your knowledge base can prevent itself from embedding in an iframe on an external domain."
updated: 2026-08-31T06:48:04Z
published: 2026-08-31T06:48:04Z
canonical: "docs.document360.com/x-frame-protection"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.document360.com/llms.txt
> Use this file to discover all available pages before exploring further.

# X-Frame protection

X-Frame protection lets you control whether your knowledge base can be embedded in ```<frame>```, ```<iframe>```, ```<embed>```, or ```<object>``` tags on external domains. Enabling this setting adds a security layer that blocks unauthorized sites from embedding your knowledge base, protecting your users from clickjacking and UI redressing attacks. This setting adds **X-Frame-Options: SAMEORIGIN** to your knowledge base pages. This prevents external websites from embedding your knowledge base and does not let you specify trusted domains.
If you want to allow specific domains to embed your knowledge base, use the **Frame ancestors** directive under **Content Security Policy** instead.

---

## When to use X-Frame protection

Enable X-Frame protection if any of the following apply to your knowledge base:

- Your knowledge base contains sensitive documentation, or you want to protect readers from clickjacking attempts by ensuring content only appears on your own domain.
- Compliance or security policies in your organization require iframe embedding restrictions.

---

## Before you begin

- You must have admin-level access to the knowledge base portal to modify security settings.
- If you use iframe-based embedding on your own domains (for example, embedding your knowledge base inside a support portal), be aware that enabling X-Frame protection will block those embeds as well. Review all existing iframe integrations before enabling this setting.
- If your articles contain third-party iframe embeds (for example, interactive demos or widgets from external tools), enabling X-Frame protection will block those embeds from loading on your knowledge base site. Disable this setting if you rely on third-party iframe content within your articles.

---

## How to enable X-Frame protection

<img src="https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/Screenshot-Enable_xframe_options.png" class="article_image" alt="Settings page showing options for X-Frame and content security policy configurations.">

1. Hover on **Settings** (<span class="fa-regular fa-gear" data-type="icon"></span>) in the left navigation bar of the knowledge base portal.
2. In the sub-menu, select **Knowledge base site** and navigate to **Security**.
3. Locate the toggle labeled **Enable X-Frame protection** and switch it on.

The setting takes effect immediately. Any external domain that attempts to embed your knowledge base using `<frame>`, `<iframe>`, `<embed>`, or `<object>` tags will be blocked.

<img src="https://cdn.document360.io/860f9f88-412e-4570-8222-d5bf2f4b7dd1/Images/Documentation/2_Screenshot-XFrame_options_before_after.png" class="article_image" alt="Before and after comparison showing X-Frame protection toggle state.">

**Example:** If your knowledge base domain is `help.example.com` and you want to stop a site like `support.test.com` from embedding your content in an iframe, turn on the **Enable X-Frame protection** toggle.

---

## Best practices

- **Combine with Content Security Policy (CSP).** X-Frame protection work best alongside a configured CSP for defense-in-depth against injection and embedding attacks.
- **Test after enabling.** Use your browser's developer tools (Network tab → inspect response headers for `X-Frame-Options`) or a tool like [securityheaders.com](https://securityheaders.com) to confirm the header is being applied correctly.

---

## FAQ

<div class="faq-wrapper" data-type="details-wrapper">
  <details open>
    <summary>
      <p>What is an iframe?</p>
    </summary>
    <div data-type="details-content">
      <p>An iframe (inline frame) is an HTML element that embeds another HTML document within the current page. Because iframes can load external content inside a trusted page, they are a common vector for clickjacking attacks. X-Frame protection help mitigate this risk by blocking unauthorized embedding.</p>
    </div>
  </details>
  <button class="details-arrow" type="button"></button>
</div>





<div class="faq-wrapper" data-type="details-wrapper">
  <details>
    <summary>
      <p>How can I test if X-Frame protection is working?</p>
    </summary>
    <div data-type="details-content">
      <p>You can verify the setting is active in two ways:</p>
      <ol>
        <li>Open your browser's developer tools, go to the <strong>Network</strong> tab, and inspect the response headers for your knowledge base page. Look for the <code>X-Frame-Options</code> header.</li>
        <li>Use a third-party header checker such as <a href="https://securityheaders.com">securityheaders.com</a> to scan your knowledge base URL and confirm the header is present.</li>
      </ol>
    </div>
  </details>
  <button class="details-arrow" type="button"></button>
</div>

<div class="faq-wrapper" data-type="details-wrapper">
  <details>
    <summary>
      <p>What are the risks of not enabling X-Frame protection?</p>
    </summary>
    <div data-type="details-content">
      <p>Without X-Frame protection, any external site can embed your knowledge base in an invisible iframe. Attackers can overlay deceptive elements on top of your interface to trick users into revealing passwords, clicking malicious links, or taking other unintended actions — a technique called clickjacking. This can lead to data breaches and loss of user trust.</p>
    </div>
  </details>
  <button class="details-arrow" type="button"></button>
</div>

<div class="faq-wrapper" data-type="details-wrapper">
  <details>
    <summary>
      <p>What is clickjacking?</p>
    </summary>
    <div data-type="details-content">
      <p>Clickjacking (also called UI redressing or UI masking) is an attack where a malicious actor places a transparent or disguised layer over a legitimate web page. Users believe they are interacting with the real page, but their clicks are captured by the attacker's hidden elements. Consequences can include malware downloads, unauthorized purchases, or inadvertent disclosure of sensitive information. X-Frame protection help prevent this by blocking your content from being embedded on unauthorized sites.</p>
    </div>
  </details>
  <button class="details-arrow" type="button"></button>
</div>

<div class="faq-wrapper" data-type="details-wrapper">
  <details>
    <summary>
      <p>What is a malicious website?</p>
    </summary>
    <div data-type="details-content">
      <p>A malicious website is a site designed to cause harm to visitors or their devices. These sites may trick visitors into downloading malware, stealing personal information, or engaging in fraudulent activities. Using X-Frame protection helps prevent your content from being embedded on such sites, enhancing your security measures against these risks.</p>
    </div>
  </details>
  <button class="details-arrow" type="button"></button>
</div>

## Related

- [CSP directive reference](/content-security-policy.md)
- [Content security policy](/content-security-policy-1.md)
- [Migrating to knowledge base widget V2](/migrating-to-knowledge-base-widget-v2.md)