# frameguard

> Middleware to set X-Frame-Options headers

Latest version **4.0.0** (published 2020-12-21) · MIT license · 0 weekly downloads

## Install

```sh
npm install frameguard
pnpm add frameguard
yarn add frameguard
bun add frameguard
```

## Health

**Score 40/100 (D)** — status: abandoned.

Positive: has types; no vulnerabilities; high maintenance score; popular repo.

Warnings: low downloads; no esm support.

Negative: abandoned.

## Facts

| | |
|---|---|
| Version | 4.0.0 |
| Published | 2020-12-21 |
| First published | 2014-10-28 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | CommonJS |
| Node | >=10.0.0 |
| Dependencies | 0 |
| Unpacked size | 5.2 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 10736 |
| Author | Adam Baldwin |
| Maintainers | evanhahn |
| Keywords | express, security, x-frame-options, clickjack |

## Links

- npm: https://www.npmjs.com/package/frameguard
- Repository: https://github.com/helmetjs/helmet
- Homepage: https://helmetjs.github.io/
- Issues: https://github.com/helmetjs/helmet/issues
- npm.io page: https://npm.io/package/frameguard

## Recent versions

- 4.0.0 (latest) — 2020-12-21
- 3.1.0 — 2019-05-05
- 3.0.0 — 2016-10-28
- 2.0.0 — 2016-04-29
- 1.1.0 — 2016-02-28
- 1.0.0 — 2015-12-18
- 0.2.2 — 2015-04-22
- 0.2.1 — 2015-02-13
- 0.2.0 — 2014-10-28
- 0.1.0 — 2014-10-28

## README

# X-Frame-Options middleware

The `X-Frame-Options` HTTP header restricts who can put your site in a frame which can help mitigate things like [clickjacking attacks](https://en.wikipedia.org/wiki/Clickjacking). The header has two modes: `DENY` and `SAMEORIGIN`.

This header is superseded by [the `frame-ancestors` Content Security Policy directive](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors) but is still useful on old browsers.

If your app does not need to be framed (and most don't) you can use `DENY`. If your site can be in frames from the same origin, you can set it to `SAMEORIGIN`.

Usage:

```javascript
const frameguard = require("frameguard");

// Don't allow me to be in ANY frames:
app.use(frameguard({ action: "deny" }));

// Only let me be framed by people of the same origin:
app.use(frameguard({ action: "sameorigin" }));
app.use(frameguard()); // defaults to sameorigin
```

A legacy action, `ALLOW-FROM`, is not supported by this middleware. [Read more here.](https://github.com/helmetjs/helmet/wiki/How-to-use-X%E2%80%93Frame%E2%80%93Options's-%60ALLOW%E2%80%93FROM%60-directive)

---
_Source: https://npm.io/package/frameguard · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._