title: X-Frame-Options not working IIS web.config
body: <p>Our site is not currently safe from clickjacking, so I went into the <em>web.config</em> and added</p>
  
  
  
  <pre class="lang-xml prettyprint-override"><code>&lt;system.webServer&gt;
      &lt;httpProtocol&gt;
          &lt;customHeaders&gt;
              &lt;add name="X-Frame-Options" value="DENY" /&gt;
          &lt;/customHeaders&gt;
      &lt;/httpProtocol&gt;
  &lt;/system.webServer&gt;
  </code></pre>
  
  <p>This is very straight forward code. My issue is that <strong>it's just not working.</strong> The questions I have are:</p>
  
  <ol>
  <li>Is there a way for me to see if the <code>X-Frame-Options</code> is in the header response? I looked for it with httpfox and got nothing, so I can't verify if the <code>web.config</code> is actually putting things in the header.</li>
  <li>Why is this not working? What can I do to test or move forward? </li>
  </ol>
  
  <p>I did try to add it in the <em>Global.asax</em> in the <code>Application_Start</code> method, but I cant seem to "hit" this method when I debug; it does not hit breakpoints. </p>
  
  <pre class="lang-cs prettyprint-override"><code>private void Application_Start(object sender, EventArgs e)
  {
      // Code that runs on application startup
      HttpContext.Current.Response.AddHeader("x-frame-options", "DENY");
  
      LogHelper.Info("Cost of Care Web Application Starting");
  }
  </code></pre>
  
  <p>I would like to add that I have tried to add it straight into the head tag and  I've also tried to add it in a meta tag like so </p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;meta http-equiv="X-Frame-Options" content="deny"&gt;
  </code></pre>