No protection from framing
WarningLow priority
Pages of this site whose response sends neither X-Frame-Options nor a Content-Security-Policy with frame-ancestors.
Why it matters
Any other site can then show the page inside a frame of its own and trick visitors into clicking on it - clickjacking.
How to fix it
Send X-Frame-Options: SAMEORIGIN, or a Content-Security-Policy with frame-ancestors 'self'.
Skitter runs this check on every crawl, and lists each page it finds with the evidence: the header, the tag or the link that gave it away.