Why it happens
Any site can place yours inside an invisible frame and trick a visitor into clicking things on it — clickjacking.
How to tell
- The free check: no X-Frame-Options and no Content-Security-Policy frame-ancestors.
The fix
- Send Content-Security-Policy: frame-ancestors 'self' (or 'none'), and X-Frame-Options: SAMEORIGIN for older browsers.
- If you embed your own pages elsewhere on purpose, list those origins instead.
The prompt for your builder
Paste this into Lovable, Bolt, Cursor, Claude Code or whatever built the app. Replace anything in capitals. It never asks you to paste a secret into a chat; keys go into your host’s environment, by you.
Prompt for your builder
Add security headers to every response my app sends: Strict-Transport-Security with a one-year max-age and includeSubDomains, X-Content-Type-Options set to nosniff, and a Content-Security-Policy frame-ancestors directive that allows only my own origin (plus X-Frame-Options SAMEORIGIN for older browsers). Show me the change in my framework's configuration file, and tell me which of these my host can set instead.
How Keelnest catches it
Every five-minute check reads the security headers. A missing one is Degraded — shown on your screens, never sent to anybody's inbox.
Know the moment this happens.
Keelnest watches your production app every five minutes and tells you in plain English what broke — with the fix. Free for your first app.