Web Security
Beginner
1 min read
X-Frame-Options and Clickjacking Prevention
Example
<?php
// Laravel middleware: comprehensive security headers
namespace App\Http\Middleware;
use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;
class SecurityHeaders
{
public function handle(Request $request, Closure $next): Response
{
$response = $next($request);
// Clickjacking prevention
$response->headers->set('X-Frame-Options', 'SAMEORIGIN');
// Modern CSP equivalent (set this in your CSP header too):
// frame-ancestors 'self' https://embed-partner.example.com
// Prevent MIME-type sniffing (stops drive-by download attacks)
$response->headers->set('X-Content-Type-Options', 'nosniff');
// Remove server fingerprinting header
$response->headers->remove('X-Powered-By');
$response->headers->remove('Server');
// Referrer policy: send referrer only on same-origin requests
$response->headers->set('Referrer-Policy', 'strict-origin-when-cross-origin');
// Permissions policy: disable features your app does not use
$response->headers->set('Permissions-Policy',
'geolocation=(), microphone=(), camera=(), payment=(), usb=()'
);
// XSS Protection header (legacy — CSP is the modern replacement)
$response->headers->set('X-XSS-Protection', '1; mode=block');
return $response;
}
}
Related Resources
Web Security Reference
Complete tag & property list
Web Security How-To Guides
Step-by-step practical guides
Web Security Exercises
Practice what you've learned
More in Web Security