Clickjacking protection is present

Clickjacking embeds your site invisibly inside an attacker-controlled iframe. A user sees the attacker's page, but their clicks land on your site's buttons — authorizing transfers, changing account settings, or submitting forms without knowing. CWE-1021 (UI Redress Attack) and OWASP A05 (Security Misconfiguration) both classify missing frame protection as a preventable failure. The fix is cheap: one header. Without it, any page on your site that performs sensitive actions is vulnerable to this class of social-engineering attack targeting legitimate authenticated sessions.

Add either X-Frame-Options or a CSP frame-ancestors directive — both protect against clickjacking, and they can coexist for broader browser coverage:

# nginx — both headers
add_header X-Frame-Options "DENY" always;
add_header Content-Security-Policy "frame-ancestors 'self'" always;

In Next.js next.config.js:

{ key: 'X-Frame-Options', value: 'DENY' }

Use DENY if your site never embeds itself in iframes. Use SAMEORIGIN if it needs to be framed from the same origin (e.g., admin embedded in a dashboard). CSP frame-ancestors takes precedence in modern browsers; X-Frame-Options covers older ones.