Why it matters
Anyone can load your site invisibly inside their page and trick your logged-in users into clicking buttons they can't see. It's called clickjacking.
How to check it yourself
Make a blank HTML file containing an iframe that points at your site and open it. If your site appears inside the frame, other people can embed it invisibly on their own pages.
What the fix involves
Send X-Frame-Options: DENY and add frame-ancestors 'none' to your Content-Security-Policy. If you embed your own site somewhere on purpose, allow only those domains.
Reference: developer.mozilla.org
How vibeliq checks it
We load your page the way a visitor's browser would, read what your server sends back, and look at a short list of well-known addresses on your site. If this turns up, your report explains it in plain English and gives you a prompt, written for Claude Code, Cursor, Lovable or whatever built your site, that fixes it in your actual codebase.