Glossary
frame-ancestors
The rule that stops another site putting your app inside an invisible frame.
What it means
frame-ancestors is the part of a Content-Security-Policy that says which sites may embed your pages in a frame. Set to none, nobody can. Set to nothing at all, anybody can.
The attack it prevents is clickjacking. Someone loads your app in a transparent frame over their own page, and a visitor who thinks they are clicking a harmless button is actually clicking yours, already signed in. It is old, simple, and still works on apps that never set the rule.
A check reads the header as served. The fix is a single directive alongside the rest of your policy. If you genuinely need to be embedded, name the sites that may do it rather than leaving the door open to all of them.
Incidents where it mattered
No incident in the library maps to this one yet.
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.
Last updated September 20, 2026