CSP frame-ancestors lets other websites embed the page in a frame
What it is
Your site sends a frame-ancestors directive in an enforced Content-Security-Policy header, but the directive is so permissive that other websites can still embed your pages in an <iframe>. The usual cause is a wildcard such as frame-ancestors * or https:.
Why X-Frame-Options does not help here
Browsers that understand frame-ancestors apply it and do not consult X-Frame-Options at all. That holds whether or not your site sends an X-Frame-Options header. So adding X-Frame-Options: SAMEORIGIN next to this directive changes nothing; the directive itself has to be tightened.
How to fix it
Replace the permissive value with the narrowest one your site can live with:
Content-Security-Policy: frame-ancestors 'none';
# or, if you embed your own pages:
Content-Security-Policy: frame-ancestors 'self';
# or with an allowlist of sites you trust:
Content-Security-Policy: frame-ancestors 'self' https://partner.example.cz;If you want older browsers without frame-ancestors support covered too, you can keep sending X-Frame-Options next to it with a matching value. Modern browsers follow the directive.
Check the result
Reload the page and look at the response headers in your browser developer tools, or run a new scan. The finding disappears once frame-ancestors no longer allows sites you do not control.