# How can I add anti-clickjacking X-Frame-Options header to my installation of Discourse?
**URL:** https://meta.discourse.org/t/how-can-i-add-anti-clickjacking-x-frame-options-header-to-my-installation-of-discourse/48596
**Category:** Development
**Created:** [13 augustus 2016 om 13:36 UTC](https://meta.discourse.org/t/how-can-i-add-anti-clickjacking-x-frame-options-header-to-my-installation-of-discourse/48596 "2016-08-13T13:36:21Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@opalizoid](https://meta.discourse.org/u/opalizoid)
#### Post date: [13 augustus 2016 om 13:36 UTC](https://meta.discourse.org/t/how-can-i-add-anti-clickjacking-x-frame-options-header-to-my-installation-of-discourse/48596/1 "2016-08-13T13:36:21Z")
I found security problem with my installation of Discourse.
How can I add http header X-Frame-Option DENY to my app.yml file?
The hosting is DigitalOcean.
I’m scanned forums by Nikto2 and Vega - Penetration Testing Toolkit.
---
### Author:  [@elijah](https://meta.discourse.org/u/elijah)
#### Post date: [14 augustus 2016 om 04:10 UTC](https://meta.discourse.org/t/how-can-i-add-anti-clickjacking-x-frame-options-header-to-my-installation-of-discourse/48596/2 "2016-08-14T04:10:43Z")
> [@Add a custom HTTP header to requests made to your Discourse](https://meta.discourse.org/t/how-to-add-a-custom-http-header-to-your-discourse/26439):
>
> Add this to your app.yml: ## Remember, this is YAML syntax - you can only have one block with a name run: - exec: echo "Beginning of custom commands" # A man's not dead while his name is still spoken. - replace: filename: "/etc/nginx/conf.d/discourse.conf" from: /location \/ {/ to: | location / { add\_header X-Clacks-Overhead "GNU Terry Pratchett"; Make sure to rebuild the container afterwards. play_button Terry Pratchett, author of the Discworld novels, …
---
### Author:  [@opalizoid](https://meta.discourse.org/u/opalizoid)
#### Post date: [14 augustus 2016 om 19:55 UTC](https://meta.discourse.org/t/how-can-i-add-anti-clickjacking-x-frame-options-header-to-my-installation-of-discourse/48596/3 "2016-08-14T19:55:08Z")
Thank you for link with method to solve problem.
---
### Author:  [@opalizoid](https://meta.discourse.org/u/opalizoid)
#### Post date: [16 augustus 2016 om 10:43 UTC](https://meta.discourse.org/t/how-can-i-add-anti-clickjacking-x-frame-options-header-to-my-installation-of-discourse/48596/4 "2016-08-16T10:43:32Z")
Problem is still with /assets/ directory.