How can I mitigate the vulnerability: "X-Frame-Options header is not set" in PHP?

Question

Someone has any idea how prevent "X-Frame-Options header is not set" vulnerability in PHP?

Answer 1

This isn't so much a PHP vulnerability as it is a "not added" feature to your web server.

You can of course throw in header("X-Frame-Options=SAMEORIGIN"); into every page...but that's not feasible simply read below and add the required data to your HTTPd config file.

https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options

Answer 2

Not sure why you would class it as a vulnerability, but you can control who is allowed to frame your site:

How to Block Iframe call

You would be safest to use:

Header always append X-Frame-Options SAMEORIGIN

In your htaccess (assuming you are using apache) as it allows you to iframe your content from the same site (you shouldn't need to use frames at all, but in my experience, when dealing with third party code you sometimes find iframes).