How to protect a website from clickjacking in Plesk for Linux

Question

How to prevent clickjacking using the Apache/nginx directives on the Plesk server?

Answer

To prevent clickjacking, add the X-Frame-Options directive with the DENY value to Apache and nginx configuration of a domain:

1. Log in to Plesk.

2. Go to Domains > example.com > Apache & nginx Settings.

   • For Apache, add this line to the Additional directives for HTTP and Additional directives for HTTPS fields:

     Header set X-Frame-Options DENY

   • For nginx, add this line to the Additional nginx directives field:

     add_header X-Frame-Options DENY;

     Note: This configuration may break some Roundcube options.

Additional Information

• RFC 7034 - HTTP Header Field X-Frame-Options