Files
wordpress/wp-includes
Sergey Biryukov aeb1e8f940 Security: Set the frame-ancestors directive in send_frame_options_header().
The `X-Frame-Options` HTTP response header is a way of controlling whether and how a document may be loaded inside of a child navigable. For sites using `Content-Security-Policy`, the `frame-ancestors` directive provides more granular control over the same situations.

Includes adding a `headers_sent()` check before sending the headers.

References:
* [https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options MDN Web Docs: X-Frame-Options header]
* [https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-ancestors MDN Web Docs: Content-Security-Policy: frame-ancestors directive]

Follow-up to [17826].

Props danielbachhuber, killerbishop, callumbw95, josephscott, nacin, chriscct7, iandunn, SergeyBiryukov.
Fixes #29429.
Built from https://develop.svn.wordpress.org/trunk@60657


git-svn-id: http://core.svn.wordpress.org/trunk@59993 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2025-08-23 14:08:30 +00:00
..