Lovable
Clickjacking protection on a Lovable app
Lovable turns a chat into a hosted app. The preview URL and the production URL both serve HTML and JavaScript to anyone who opens them. Variables that the framework marks as public, and secrets pasted into a client component, travel with that bundle.
Whether another site can frame the page.
What the scan can see
The scan looks for X-Frame-Options or a CSP frame-ancestors directive. One of them is enough. If both are missing, the finding is that the page can be framed.
What it does not do
We do not embed your page in a test frame. The header is the evidence.
A scan of a Lovable URL does not open the Lovable project, the chat history, or env vars that stayed on the server. If the browser never downloaded it, this check will not see it.
What to do next
Add Content-Security-Policy: frame-ancestors 'none', or X-Frame-Options: DENY, unless a specific partner must embed the page.
Questions
Does this open my Lovable project?
No. A scan of a Lovable URL does not open the Lovable project, the chat history, or env vars that stayed on the server. If the browser never downloaded it, this check will not see it.
Can the scan prove clickjacking protection is fully fixed?
We do not embed your page in a test frame. The header is the evidence.
What should I do if the scan finds it?
Add Content-Security-Policy: frame-ancestors 'none', or X-Frame-Options: DENY, unless a specific partner must embed the page.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.