---
title: Clickjacking protection
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

By default, the pages of Kentico Portal Engine websites cannot be embedded into frames rendered on external sites. This framing restriction is achieved by including the [X-Frame-Options](https://en.wikipedia.org/wiki/Clickjacking#X-Frame-Options) header in the HTTP response:

```none

X-Frame-Options: SAMEORIGIN

```

The header ensures that pages can only be displayed in frames if they **originate on the same host name and server** as the parent page. Otherwise browsers do not render them.

The same-origin policy can help protect against clickjacking attacks that use framing. Clickjacking is a type of attack where the attacker tricks website users into clicking something different than what they see, thus performing an action that for example reveals confidential data or has another negative effect on the user or website. In a typical clickjacking scenario, the attacker places a transparent frame within a page, that contains a button or a link, over another element on a website. The underlying element can be an image or a video, which the users expect to play when they click it. Instead, they click the concealed link or button. This way the attacker can make the users perform unintended actions, usually on websites where the users are authenticated.

If you need to intentionally display your site's pages within a frame on another domain, you can disable the same-origin policy for specific pages or website sections. To do that, add the **CMSXFrameOptionsExcluded** key into the _appSettings_ section of your web.config file:

```html

<add key="CMSXFrameOptionsExcluded" value="/Services;/Products;/Partners" />

```

The system excludes all pages under the specified paths from the clickjacking protection.

- You can enter any alias path as a value.
- To exclude multiple paths, enter values separated by semicolons (;).
- Entering "/" disables the protection completely.

### Special cases where the X-Frame-Options header is not included

There are a few special cases where the clickjacking protection is disabled by the system.

These cases include [preview modes of objects](https://docs.kentico.com/k9/developing-websites/previewing-design-changes.md) (for example, transformations) which can be displayed in the context of different websites and different domains. To display the previews of these objects properly, Kentico does not include the X-Frame-Options header in such pages. Therefore, to maintain the security protection against clickjacking, Kentico adds a special **clickjacking hash** to the URL of the particular frame. The content of the frame is displayed only if hash validation is successful. Otherwise the data is considered malicious and the content from the different domain is not rendered.