What are security headers?
The X-Frame-Options HTTP response header is used to indicate whether a browser is allowed to render a page in a <frame>, <iframe>, <embed>, or <object>. This security header instructs the browser to prevent any site with this header in the response from being rendered within a frame, thus avoiding click-jacking attacks.
Security headers in Instapage
The HTTP Strict Transport Security (HSTS), X-Frame-Options, X-XSS-Protection, and X-Content-Type-Options headers are enabled by default on all CNAME published landing pages in Instapage.
The directive available is the max-age directive, which is 1 year.
Custom security headers
If you need custom security headers, you can set that up server-side by publishing through our WordPress or Drupal plugins, or a reverse proxy.
The Drupal and WordPress plugins only proxy requests from our infrastructure, but you will still have full control over which headers you want to set for your pages, as it is your server connecting with the visitor's browser.
Alternatively, if you have an experienced developer on your team and are interested in publishing through Reverse Proxy, we offer instructions on setting up Reverse Proxy with Instapage for Convert Plan users.