Bolt
Clickjacking protection on a Bolt app
Bolt serves a live preview from the project you are editing. That preview is a public address. Code that looks private in the editor is still in the script the preview downloads.
Whether another site can frame the page.
What the scan can see
The scan looks for X-Frame-Options or a CSP frame-ancestors directive. One of them is enough. If both are missing, the finding is that the page can be framed.
What it does not do
We do not embed your page in a test frame. The header is the evidence.
The scan does not sign into Bolt or read the editor. It only requests the URL you paste and a short, fixed list of paths on that host.
What to do next
Add Content-Security-Policy: frame-ancestors 'none', or X-Frame-Options: DENY, unless a specific partner must embed the page.
Questions
Does this open my Bolt project?
No. The scan does not sign into Bolt or read the editor. It only requests the URL you paste and a short, fixed list of paths on that host.
Can the scan prove clickjacking protection is fully fixed?
We do not embed your page in a test frame. The header is the evidence.
What should I do if the scan finds it?
Add Content-Security-Policy: frame-ancestors 'none', or X-Frame-Options: DENY, unless a specific partner must embed the page.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.