Merge pull request #6592 from saurabhraghuvanshii/clickjacking

jamieplu · web-flow · commit 9a438bae95ca · 2025-07-14T18:09:48.000-05:00
feat: added `X-Frame-Options` and `CSP` for Prevent Clickjacking
diff --git a/_headers b/_headers
@@ -1,3 +1,8 @@
+# Security headers to prevent clickjacking
+/*
+  X-Frame-Options: SAMEORIGIN
+  Content-Security-Policy: frame-ancestors 'self'
+
 # Cache static resources for 10 months
 /*.js
 /*.css
