https://shipreadyai.dev/learn/findings/o2-frame-protection-missing

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# Framing is not restricted

Another site can load your pages inside an invisible frame and trick a signed in visitor into clicking things they cannot see.

## Why AI-built apps get this

Response headers are written by nobody. Your framework does not add them, your builder does not add them, and your host adds one or two at most. They are the clearest example of a gap that no tool closes on your behalf, which is why almost every app built by a prompt ships without them.

## Evidence line

GET https://example.com returned no strict-transport-security header

## The fix

Add X-Frame-Options: DENY, or a frame-ancestors 'none' directive in your content policy.

## Prompt

Set the X-Frame-Options response header to DENY, and add frame-ancestors 'none' to the Content-Security-Policy (use SAMEORIGIN and 'self' only if the app embeds itself) on every HTML response. It stops another site from loading this app inside an invisible frame to hijack clicks. Add it wherever this app sets response headers: the server framework, a middleware, or the hosting platform's headers configuration. Verify by requesting the page with curl -I.