# Security plugins and headers

> The frame headers AjaxPress needs, and what to check in Wordfence, Solid Security, Really Simple Security and similar plugins.

Source: https://arraystory.com/docs/ajaxpress/security-plugins-and-headers/

AjaxPress shows each page inside a frame on your own site. Security settings that forbid your pages from appearing in **any** frame, even your own, leave AjaxPress with a blank page. Everything else in security plugins works as usual.

## The one header that matters

Browsers decide whether a page may be framed from two response headers. Check yours, and make sure they allow your own site:

| Header | Blocks AjaxPress | Works with AjaxPress |
| --- | --- | --- |
| `X-Frame-Options` | `DENY` | `SAMEORIGIN`, or no header |
| `Content-Security-Policy` | `frame-ancestors 'none'` | `frame-ancestors 'self'`, or no `frame-ancestors` |

Both working options still stop **other** websites from framing yours, which is what these headers are for. So switching from `DENY` to `SAMEORIGIN` keeps you protected against clickjacking.

If your policy has a `frame-src` or `child-src` rule, it must include `'self'` too.

## How to check your headers

1. Open your site, then the browser's developer tools (<kbd>F12</kbd>).
2. Go to **Network**, reload, and click the first request (your page).
3. Under **Response Headers**, look for `x-frame-options` and `content-security-policy`.

Or run this in a terminal:

```bash
curl -sI https://example.com/ | grep -iE 'x-frame-options|content-security-policy'
```

## Where these headers come from

- **Security plugins** with a "security headers" or "clickjacking protection" option, such as Really Simple Security, Solid Security, All-In-One Security, and dedicated header plugins. Set frame options to `SAMEORIGIN`.
- **Your host**, in its control panel's security or header settings.
- **Your server configuration**: an `.htaccess` file on Apache or LiteSpeed, or the site's Nginx configuration.
- **Cloudflare**: a Transform Rule or a Worker that adds response headers.

## Other security features

| Feature | With AjaxPress |
| --- | --- |
| Firewall and malware scanning | No effect |
| Two-factor login, login CAPTCHA | Works. If signing in misbehaves, turn on [Full Page Reload on Login & Registration](https://arraystory.com/docs/ajaxpress/full-page-reload-on-login/) |
| Custom login URL (hiding `wp-login.php`) | Works |
| Rate limiting of page views | Each page change is one page request, as without AjaxPress. With [prefetch](https://arraystory.com/docs/ajaxpress/prefetch/) on, hovering adds a few more, so very strict limits may need raising |
| Blocking bots or countries | No effect on real visitors |

## Symptoms

A header that blocks framing shows up as a white or empty page after clicking a link, or right when the first page loads, often with this in the browser console:

```text
Refused to display 'https://example.com/' in a frame because it set 'X-Frame-Options' to 'deny'.
```

See [A page is blank or the loader never finishes](https://arraystory.com/docs/ajaxpress/blank-page-or-loader-never-finishes/).