Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to understand when Framebusting should and shouldn't be used. At first brush I'd want to apply that to all pages in my site and generating exceptions as necessary.

On the other hand, if I were to take a minimalist approach, I would think I would want to apply this security to my login page.

  • Is there any reason why I shouldn't apply framebusting to a login page?

  • Are there any other related best practices?

share|improve this question
up vote 1 down vote accepted

From what I've seen Framebusting as a technique is becoming somewhat deprecated as a defence against click-jacking style attacks in favour of setting the X-Frame-Options header (e.g. the OWASP page here and here). Browser support for the X-Frame-Options headers seems to go back to IE8 so unless you have a really old set of browsers to support it should work ok.

So the short answer is that I'd recommend going down that line rather than using Framebusting Javascript.

share|improve this answer
So I should use X-Frame-Options on all pages in a site? ... likely starting at the login page? – LamonteCristo Feb 22 '13 at 16:11
I'd say so, If the site doesn't require frames at all then I'd see no downside to setting X-FRAME-OPTIONS 'DENY' for all pages. – Rоry McCune Feb 22 '13 at 16:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.