Set Xframe options to prevent embedding third-party websites

---
title: Set Xframe options to prevent embedding third-party websites
description: Configure this property to prevent the content of a web-application from being embedded in a third-party site.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/platform-security/instance-security-hardening-settings/sc-xframe-options.html
release: brazil
product: Instance Security Hardening Settings
classification: instance-security-hardening-settings
topic_type: reference
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Configuration, Hardening settings, Platform Security]
---

# Set Xframe options to prevent embedding third-party websites

Configure this property to prevent the content of a web-application from being embedded in a third-party site.

If the **com.glide.cs.embed.xframe\_options** system property is not set to the recommended value of `DENY` or `SAMEORIGIN`, then content of the web application could be embedded in a third-party site using an ALLOW-FROM URI.

Ensure the property **com.glide.cs.embed.xframe\_options** is set to `DENY` or `SAMEORIGIN`.

## More information

<table id="table_ajc_b43_3kb"><thead><tr><th>

Attribute

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Configuration name

</td><td>

**com.glide.cs.embed.xframe\_options**

</td></tr><tr><td>

Configuration type

</td><td>

System Properties \(/sys\_properties\_list.do\)

</td></tr><tr><td>

Data type

</td><td>

String

</td></tr><tr><td>

Recommended value

</td><td>

`DENY` or `SAMEORIGIN`

</td></tr><tr><td>

Default value

</td><td>

sameorigin

</td></tr><tr><td>

Fallback value

</td><td>

&lt;empty&gt;

</td></tr><tr><td>

Category

</td><td>

[Configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/platform-security/instance-security-hardening-settings/sc-configuration.md)

</td></tr><tr><td>

Security risk

</td><td>

-   Severity score: 3.1
-   CVSS score: Low
-   Security risk details: Allowing untrusted third-party sites could enable attacks such as clickjacking.

</td></tr><tr><td>

Dependencies and prerequisites

</td><td>

None

</td></tr></tbody>
</table>**Parent Topic:**[Configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/platform-security/instance-security-hardening-settings/sc-configuration.md)