Response headers - Web Security Best Practices

Protect against clickjacking attacks by restricting how your pages can be embedded within iframes. Clickjacking attacks involve an attacker displaying your pages within an iframe on a site they control. For example, an attacker could overlay a UI layer over an iframe to trick visitors into triggering actions on your page as well overlaying form fields to steal data. Clickjacking has been used to exploit users into sharing links on social networks, clicking ads and stealing passwords. Protect against these attacks using the X-Frame-Options response header to restrict which hosts are allowed to embed your pages. The possible options are 1) DENY to restricts all URLs 2) SAMEORIGIN to allow only URLs from the same origin as your page 3) ALLOW-FROM to allow from a specific origin. For example, X-Frame-Options: DENY will block all iframe usage. You should use a setting that’s as restrictive as possible.

Protect against XSS attacks by enabling browser XSS safeguards. XSS attacks involve an attacker injecting code into a page that is being sent to users. Some browsers have built-in XSS protection that is enabled by adding X-XSS-Protection: 1; mode=block to the response header of each page. This setting will stop the page being rendered if the browser detects an XSS attack. Note that this should only be considered as a last resort defence against XSS attacks. Your site should be thoroughly reviewed and built with XSS safeguards in mind to prevent injection attempts from ever reaching the browser.