---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Set Xframe options to prevent embedding third-party websites

# Set Xframe options to prevent embedding third-party websites {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Configure this property to prevent the content of a web-application from being embedded in a third-party site.
If the com.glide.cs.embed.xframe_options system property is not set to the recommended value of <kbd class="ph userinput">DENY</kbd> or <kbd class="ph userinput">SAMEORIGIN</kbd>, then content of the web application could be
embedded in a third-party site using an ALLOW-FROM URI.

Ensure the property com.glide.cs.embed.xframe_options is set to <kbd class="ph userinput">DENY</kbd> or <kbd class="ph userinput">SAMEORIGIN</kbd>.

## More information {#sc-xframe-options__section_qhx_1b1_xwb}

{#sc-xframe-options__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | com.glide.cs.embed.xframe_options |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | String |
| Recommended value | <kbd class="ph userinput">DENY</kbd> or <kbd class="ph userinput">SAMEORIGIN</kbd> |
| Default value | \<none\> |
| Fallback value | \<empty\> |
| Category | [Configuration](https://www.servicenow.com/docs/ZhbsoKbEcZI6v4jboYyLZQ "The Configuration category ensures applications have a secure build environment and hardened third party library components. Specifically, ensuring a build and deploy pipeline is repeatable and includes automated testing and prevents known security issues from being deployed. This includes keeping dependencies up to date and free from known vulnerabilities.") |
| Security risk | * Severity score: 3.1 * CVSS score: Low * Security risk details: Allowing untrusted third-party sites could enable attacks such as clickjacking. {#sc-xframe-options__ul_g1g_3sf_xwb} |
| Dependencies and prerequisites | None |
[ ]

{#sc-xframe-options__table_ajc_b43_3kb}