Scammers can embed your site

Play this card on https://example.com. Everything a developer (or your AI agent) needs to fix and verify it — free. Fixing your own site is never paywalled.

visibilityCard text — what this means

Demo public response headers include neither X-Frame-Options nor a frame-ancestors directive.

X-Frame-Options or CSP frame-ancestors reduces clickjacking and unwanted embedding risk.

Preview ingestion checks only sanitized headers on the submitted public target and does not crawl every route.

playing_cardsHow to play it

Send X-Frame-Options or a CSP frame-ancestors directive on public browser responses.

1Decide whether the service should allow any third-party embedding.
2Add X-Frame-Options: DENY or SAMEORIGIN, or add a CSP frame-ancestors directive.
3Collect fresh response-header evidence showing frame protection.

Fix it on your stack

nginx

# in your server { } block
add_header X-Frame-Options "SAMEORIGIN" always;

infoFor modern browsers you can instead use a CSP frame-ancestors directive; X-Frame-Options is the widest-supported option.

workspace_premiumClaim your relic

Sanitized response headers showing X-Frame-Options or CSP frame-ancestors on the public target.

Evidence needed: Sanitized response headers showing X-Frame-Options or CSP frame-ancestors on the public target.

Related controls

Readiness mapping only — evidence relevant to these controls. Pazmo does not determine, certify, or guarantee compliance.

A.8.9 · Configuration management (ISO/IEC 27001:2022)
CC6.6 · Logical access — external boundary protection (SOC 2)

Browser hardeningVendor readiness

smart_toyHand this card to your AI agent Back to your run