What it is

Your site can be loaded inside an invisible frame on someone else's page ("clickjacking") — a common trick to make visitors click a real button on your site (follow, buy, change a setting) while believing they're clicking something else.

How to fix it

Add an X-Frame-Options header (or a frame-ancestors rule in your CSP) that denies framing, unless you deliberately embed this site elsewhere. If you're not sure how, install the WordPress Plugin: its Security tab applies fixes like this one automatically.

In depth

Your website can currently be loaded inside a hidden frame on another person's malicious website, which means attackers could trick your visitors into clicking buttons on your site without realizing it. For example, someone visiting a compromised website could unknowingly click a button that follows a spammer account on your site, makes a purchase, or changes their password, all while thinking they're interacting with something else entirely. This is called clickjacking and it puts your visitors' accounts and data at risk. To fix this, your web server needs to send a special instruction called the X-Frame-Options header that tells browsers your site should never be loaded inside another website's frame, protecting visitors from this trick. The easiest way to add this protection is to install a WordPress security plugin like Wordfence or All In One WP Security, which automatically adds this header for you without any technical work on your part. If your hosting provider offers a security settings area in your control panel, you might also be able to add this header there directly, though a plugin is usually simpler for most site owners.