https://shipreadyai.dev/glossary/frame-ancestors

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# frame-ancestors

The rule that stops another site putting your app inside an invisible frame.

frame-ancestors is the part of a Content-Security-Policy that says which sites may embed your pages in a frame. Set to none, nobody can. Set to nothing at all, anybody can.

The attack it prevents is clickjacking. Someone loads your app in a transparent frame over their own page, and a visitor who thinks they are clicking a harmless button is actually clicking yours, already signed in. It is old, simple, and still works on apps that never set the rule.

A check reads the header as served. The fix is a single directive alongside the rest of your policy. If you genuinely need to be embedded, name the sites that may do it rather than leaving the door open to all of them.