diff --git a/assets/vhosts/drupal-ssl.nginxconf b/assets/vhosts/drupal-ssl.nginxconf
index 05a5b1f..fcbd1b9 100644
--- a/assets/vhosts/drupal-ssl.nginxconf
+++ b/assets/vhosts/drupal-ssl.nginxconf
@@ -136,5 +136,5 @@ server {
   }
 
   # website should not be displayed inside a <frame>, an <iframe> or an <object>
-  add_header X-Frame-Options DENY;
+  add_header X-Frame-Options SAMEORIGIN;;
 }
diff --git a/assets/vhosts/drupal.nginxconf b/assets/vhosts/drupal.nginxconf
index c3314a0..19d2f32 100644
--- a/assets/vhosts/drupal.nginxconf
+++ b/assets/vhosts/drupal.nginxconf
@@ -110,4 +110,8 @@ server {
       expires max;
       log_not_found off;
     }
+
+    # website should not be displayed inside a <frame>, an <iframe> or an <object>
+    add_header X-Frame-Options SAMEORIGIN;;
+
 }
diff --git a/assets/vhosts/simple-phpfpm-ssl.nginxconf b/assets/vhosts/simple-phpfpm-ssl.nginxconf
index 8a53196..2092d21 100644
--- a/assets/vhosts/simple-phpfpm-ssl.nginxconf
+++ b/assets/vhosts/simple-phpfpm-ssl.nginxconf
@@ -59,4 +59,8 @@ server {
   location ~ /\.ht {
     deny all;
   }
+
+  # website should not be displayed inside a <frame>, an <iframe> or an <object>
+  add_header X-Frame-Options SAMEORIGIN;;
+
 }
diff --git a/assets/vhosts/simple-phpfpm.nginxconf b/assets/vhosts/simple-phpfpm.nginxconf
index 3a2b8d6..e20c02b 100644
--- a/assets/vhosts/simple-phpfpm.nginxconf
+++ b/assets/vhosts/simple-phpfpm.nginxconf
@@ -35,4 +35,8 @@ server {
   location ~ /\.ht {
     deny all;
   }
+
+  # website should not be displayed inside a <frame>, an <iframe> or an <object>
+  add_header X-Frame-Options SAMEORIGIN;;
+
 }