There are two possible values for X-Frame-Options: DENY - the page cannot be displayed in a frame, regardless of the site attempting to do so; SAMEORIGIN - the page can only be displayed in a frame on the same origin as the page itself.