X-Frame-Options header not set
Click hijack
Header ('Xmurf frames OptionsVal SAMEORIGIN')
When the value is DENY, the browser will refuse to load any frame page on the current page; if the value is SAMEORIGIN, the address of the frame page can only be the page under the same origin domain name; if the value is ALLOW-FROM, you can define the page address that allows frame to load.
