Missing X-Frame-Options header

What does this mean?

Without this header, another website could embed your site inside an invisible frame and trick visitors into clicking things they don't realize they're clicking ("clickjacking") — for example, silently submitting a form.

What are the potential impacts?

• Another site can load your page inside an invisible iframe and overlay convincing-looking buttons, tricking visitors into clicking things on your site they never intended to — "delete account," "confirm purchase," or "authorize payment," for example.
• This is a well-known technique for hijacking social buttons, forcing unwanted purchases, or silently changing account settings.
• Because the click genuinely happens on your real page, standard fraud or abuse detection on your side won't necessarily catch it — it looks like a normal user action.