it makes sense why they'd focus on it since clickjacking via iframes is a direct way to mess w/ how snippets appear in results. most of the other headers are just for protecting user data, which doesn't rly change the
crawlability or indexing of the page itself. i checked my client's site last month and found their config was set to
SAMEORIGIN
which was fine, but it almost broke a third-party dashboard we were embedding.
>it's wild that almost all other security headers are ignoredthe real headache is trying to balance security with actually being able to use iframes for legitimate embeds