I run a couple of websites, so I'm just wondering what is the appropriate use of clickjacking protection like the x-frame-options response header? What pages are susceptible to this kind of attack on my users?
In general, every page which allows the user to change data is a potential target for clickjacking. The goal of clickjacking is to trick the victim into taking actions on the attacker's behalf. This affects every page with forms or buttons or other UI elements which have persistent effects.
However, I strongly recommend against taking the blacklist approach and picking individual pages for protection. It's very easy to overlook something, the pages may change over time, and even a seemingly harmless page can become dangerous through an additional vulnerability. For example, the attacker might have found a cross-site scripting vulnerability on your site. By combining this with clickjacking, they may be able to take arbitrary actions regardless of what you originally designed the page for.
The correct approach is whitelisting: You protect every page except those which absolutely must be framed.
Note that setting the header to anything other than
DENY isn't reliable. When faced with nested frames, current browsers usually just check the top-level site. This means you can end up with situations like this: You allow the site
good.com to embed your page as a frame, but this site also embeds
evil.com. This allows
evil.com to frame your page despite the
X-FRAME-OPTIONS header being set to
good.com, because the top-level site is indeed
So if you do allow framing, expect the page to be framed on any site, not just the one you've chosen.