classic asp return X-Frame-Options HTTP header with page's response

Question

I am working on making my site PCI compliant and their scan states I need to return the X-Frame-Options HTTP header with the page's response (This prevents the page's content from being rendered by another site when using the frame or iframe HTML tags) .

I tried a JavaScript workaround from here:

https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet

but it doesn't seem to be Security Metrics happy - my offending pages (basically all of them) are still showing on the scan.

How do I do this in classic asp?

Answer 1

Just set the header in the ASP page using

<%
Call Response.AddHeader("X-FRAME-OPTIONS", "DENY")
%>

or set it from inside IIS so it's applied across a site, folder or page.