Although I wrote about Internet Explorer 8 ("IE 8") new features before, back before the final version was released, I failed to mention one very interesting and useful facility (for webmasters) in this new version of Microsoft's browser: its ability to prevent other sites from putting your website in a frame.
Microsoft calls it a "clickjacking" defence (or "defense" if you use US English) because it is supposed to help to prevent malicious websites from hijacking the clicks on your page. That is, it is designed to prevent criminals and whatnot from putting your website in a frame, and using a script (a computer program that is embedded in their web page) to redirect any clicks your visitors make on your page to a destination of the criminals' choosing.
Basically, nothing beats a specially designed facility built into a web browser intended from ground-up to prevent framing by external sites. And this is the facility that is provided with IE 8. Hopefully, all the other browser vendors will also follow suit and implement this and not invent a different method that will add new headaches for us webmasters (just when IE 8's new-found standards compliance means that we can finally make one site design that work in all browsers).
Update: The latest versions of all major browsers, that is, Internet Explorer, Firefox, Opera, Chrome and Safari, now support the X-Frame-Options method described below.
Note: this article is meant for existing webmasters. If you are a webmaster-to-be, looking to see how easy or hard it is to make your own website, please read the How to Start / Create Your Own Website: The Beginner's A-Z Guide instead. If you are an ordinary computer user, searching for ways to protect your own computer, install an antivirus program instead, such as one of those on the Free Antivirus Software page, and keep it updated.
To prevent your site from being framed, your web server (the program used by your web host to "serve" your website to your users)
needs to send a special instruction to your visitors' web browser. This instruction is called the "
There are currently two variations of the
X-FRAME-OPTIONS header. The first, specifying "
DENY", tells IE 8
that your website is not be placed in a frame under any circumstance. The second, specifying "
SAMEORIGIN", instructs IE 8
not to put your site in a frame unless the framing page is also on the same domain. That is to say, in the second case, only a
web page on your own domain can put the other pages on
that domain in a frame. Sites on other domains (even if they belong to you) will not be allowed to.
For the following procedure to work, your site must currently be hosted on an Apache web server, and your web host must allow you to
change the server settings using a
.htaccess file. This probably applies to most people using a
commercial web host, although you may want to
check with your web host to see if this is true for you as well.
Go to the folder on your website that contains your home page file. That is, if your home page is
to the folder that contains the
index.html file for your home page. (Be careful, there may be an
index.html file in
every subfolder, so make sure you go to the topmost web folder, the one where your home page file lives.)
If there is a
.htaccess file in that folder, download it to your computer. If you don't know where to download it to,
just put it on your desktop. Note that this must be done using your FTP program. It cannot be done using a web browser. For example, you can't
download it by going to your website with
www.example.com/.htaccess. It won't work (unless your web host has misconfigured the
If you can't find any
.htaccess file in that folder, make sure that your FTP program is configured to show you hidden files.
If it is, and you still can't find the
.htaccess file, it means you don't have one. That's okay. We'll just create our own below.
Start up an ASCII tex editor. That is, if you use Windows, start up Notepad. (To do this on Vista, hit the nameless round button that has a multi-coloured icon on the bottom left of your monitor, type "notepad" and hit the ENTER key. If you use XP, click the "Start" button, go to the "Programs" folder, then the "Accessories" folder, and click the "Notepad" line.) Very important: do not use a wordprocessor. Do not use Microsoft Word. Do not use Wordpad. Do not use Microsoft Office, Excel, Powerpoint or any fancy software that allows you to do things like underline sentences or make words bold or the like. Those are the wrong type of programs for the task. Don't try to be clever here, or you may disable your entire website.
If you have downloaded an existing
.htaccess file, open that file in the editor. To do this, click the "File" menu, followed
by the "Open" menu item, look for the
.htaccess file on your desktop (or wherever you put it earlier), and click the "Open"
If you don't have an existing
.htaccess file, skip to the next step.
Add one of the following lines to the file. If you're adding to an existing file, go to the end of the file, hit the ENTER key to make a new line and then add the line. If yours is a new file (ie, empty), just start typing. (Actually, instead of typing, copy and paste the line I supplied. There's less room for typing errors that way.)
For those who only want to prevent sites other than your current site from framing your pages, add the following line.
For those who want to prevent all sites (including the one that you're protecting) from framing your site, add the following line instead.
Do not add both lines. Either add the SAMEORIGIN line or the DENY line, not both. If you've forgotten which option does what, go back and reread the explanation.
Hit the ENTER key to add a blank line after adding the line.
Save the file (click the "File" menu, followed by the "Save" menu item). If you are creating a brand new file because you didn't have a
.htaccess file previously, make sure you type
".htaccess", including the quotes (note: I said "including"),
as the filename into the "Save As" dialog box. Then publish it, using your FTP program, to the same location you previously obtained it from. If there wasn't
such a file before, make sure you publish it to the same folder as your website's home page.
That's it. All browsers that support this facility, including IE8, should now refuse to let other sites put any of your web pages in a frame. If you used the DENY option, it will also refuse to let your own site frame its own pages.
Do you find this article useful? You can learn of new articles and scripts that are published on thesitewizard.com by subscribing to the RSS feed. Simply point your RSS feed reader or a browser that supports RSS feeds at http://www.thesitewizard.com/thesitewizard.xml. You can read more about how to subscribe to RSS site feeds from my RSS FAQ.
This article is copyrighted. Please do not reproduce this article in whole or part, in any form, without obtaining my written permission.
It will appear on your page as: