How has use of framing protection security headers changed in the past 3 years?, (Wed, Jun 10th)

Back in 2023, I wrote a diary[ 1 ] discussing how commonly X-Frame-Options and CSP headers containing the frame-ancestors directive were used on 1 million most popular domains on the internet (based on the Tranco list[ 2 ]), and how they were set. Given that three years have passed since then, I thought it might be interesting to repeat the analysis and see what – if anything – has changed in the meantime. Before we get to the data, however, let’s briefly recap what the headers in question do an