How has use of framing protection security headers changed in the past 3 years?, (Wed, Jun 10th)

This diary analyzes HTTPS responses for the Tranco top 1M domains to measure adoption of X-Frame-Options and CSP frame-ancestors headers, comparing 2023 and 2026 data. It finds overall increased deployment—especially of CSP frame-ancestors—while noting gaps remain (many popular sites still lack framing protection), explains the methodology and directive breakdowns (SAMEORIGIN, DENY, 'self', 'none'), and highlights the security importance for mitigating iframe-based/phishing attacks.