title: X-Frame-Options not blocking iframe
body: <p>I have set the X-Frame-Options header in Apache to DENY. The response header is correctly sent to the browser (see image). I just created a simple HTML file that loads an iframe which is loaded without any issue. I also checked Chrome devtools and the response header returns &quot;x-frame-options: DENY&quot;. I was assuming that the header would block all iframes from being loaded?</p>
  <p><a href="https://i.stack.imgur.com/XWjaH.png" rel="nofollow noreferrer">X-Frame-Options Response</a></p>
  <p><a href="https://i.stack.imgur.com/8b5el.png" rel="nofollow noreferrer">Full Response Header</a></p>