I am running 3 sites through Cloudflare, each hosted by a different hosting provider (Hostway, A2, GoDaddy). I added this X-Frame Option to the .htaccess for each of them:Header set X-Frame-Options "SAMEORIGIN"
Then I purged the site caches on Cloudflare.
When checking the site inspector or with the Mozilla Observatory none of my sites features the X-Frame Option.
All 3 hosting providers tell me they support the X-Frame, for instance, Hostway Support sent me this: “We can confirm that X-Frame options does work on the server, but it’s possible CloudFlare is stripping the headers or caching resources without them. It is advisable to verify this with with CloudFlare.”
Any suggestions as to what settings I need to change?