X-Frame-Options Reference
DENY, SAMEORIGIN, and ALLOW-FROM -- the definitive reference. Browser support for every directive, the meta tag trap, and the CSP frame-ancestors replacement.
Docs
Step-by-step guides for adding clickjacking protection on your stack.
Reference
CSP frame-ancestors Reference
The modern clickjacking defense. Syntax, the wildcard gotcha, how it differs from X-Frame-Options, the default-src fallback that does not exist, and why it cannot be set via a meta tag.
Stack Guides
NGINX
The always parameter, inheritance trap, proxy mode, and curl verification. Covers add_header at http, server, and location levels.
Apache
mod_headers Header directive, .htaccess vs virtual host, the always keyword, and the duplicate-header table gotcha when proxying to backends.
Cloudflare
Three methods: Managed Transforms (one-click), Response Header Transform Rules (dashboard + API), and Pages _headers file for static sites.
Next.js + Vercel
next.config.mjs headers() function, conditional headers with has/missing, middleware for dynamic logic, and vercel.json for non-Next.js Vercel deployments.
WordPress
Four ways to add protection: wp-config.php, theme functions.php with wp_headers filter, .htaccess, and security plugins (Really Simple Security, Sucuri, Shield Security).