diff --git a/ai_review/security_middleware.py b/ai_review/security_middleware.py
index 1cde8c4..be880f6 100644
--- a/ai_review/security_middleware.py
+++ b/ai_review/security_middleware.py
@@ -12,7 +12,7 @@ def apply_security_headers(app, csp_policy=None):
     @app.after_request
     def set_security_headers(response):
         # Prevent clickjacking
-        response.headers['X-Frame-Options'] = 'DENY'
+        response.headers['X-Frame-Options'] = 'SAMEORIGIN'
         # XSS protection (legacy browsers)
         response.headers['X-XSS-Protection'] = '1; mode=block'
         # Prevent MIME type sniffing
@@ -33,7 +33,7 @@ def apply_security_headers(app, csp_policy=None):
                 "img-src 'self' data: blob:; "
                 "font-src 'self'; "
                 "connect-src 'self'; "
-                "frame-ancestors 'none'"
+                "frame-ancestors 'self'"
             )
 
         # Remove server header info
diff --git a/db/security_middleware.py b/db/security_middleware.py
index 7e5ee15..8f69800 100644
--- a/db/security_middleware.py
+++ b/db/security_middleware.py
@@ -12,7 +12,7 @@ def apply_security_headers(app, csp_policy=None):
     @app.after_request
     def set_security_headers(response):
         # Prevent clickjacking
-        response.headers['X-Frame-Options'] = 'DENY'
+        response.headers['X-Frame-Options'] = 'SAMEORIGIN'
         # XSS protection (legacy browsers)
         response.headers['X-XSS-Protection'] = '1; mode=block'
         # Prevent MIME type sniffing
@@ -33,7 +33,7 @@ def apply_security_headers(app, csp_policy=None):
                 "img-src 'self' data: blob:; "
                 "font-src 'self'; "
                 "connect-src 'self'; "
-                "frame-ancestors 'none'"
+                "frame-ancestors 'self'"
             )
 
         # Remove server header info
diff --git a/dnfs/security_middleware.py b/dnfs/security_middleware.py
index 1cde8c4..be880f6 100644
--- a/dnfs/security_middleware.py
+++ b/dnfs/security_middleware.py
@@ -12,7 +12,7 @@ def apply_security_headers(app, csp_policy=None):
     @app.after_request
     def set_security_headers(response):
         # Prevent clickjacking
-        response.headers['X-Frame-Options'] = 'DENY'
+        response.headers['X-Frame-Options'] = 'SAMEORIGIN'
         # XSS protection (legacy browsers)
         response.headers['X-XSS-Protection'] = '1; mode=block'
         # Prevent MIME type sniffing
@@ -33,7 +33,7 @@ def apply_security_headers(app, csp_policy=None):
                 "img-src 'self' data: blob:; "
                 "font-src 'self'; "
                 "connect-src 'self'; "
-                "frame-ancestors 'none'"
+                "frame-ancestors 'self'"
             )
 
         # Remove server header info
diff --git a/static/security_middleware.py b/static/security_middleware.py
index 1cde8c4..f71c34a 100644
--- a/static/security_middleware.py
+++ b/static/security_middleware.py
@@ -11,8 +11,8 @@ def apply_security_headers(app, csp_policy=None):
 
     @app.after_request
     def set_security_headers(response):
-        # Prevent clickjacking
-        response.headers['X-Frame-Options'] = 'DENY'
+        # Prevent clickjacking (SAMEORIGIN: 允许本站 iframe 嵌套，如登录页条例弹窗)
+        response.headers['X-Frame-Options'] = 'SAMEORIGIN'
         # XSS protection (legacy browsers)
         response.headers['X-XSS-Protection'] = '1; mode=block'
         # Prevent MIME type sniffing
@@ -33,7 +33,7 @@ def apply_security_headers(app, csp_policy=None):
                 "img-src 'self' data: blob:; "
                 "font-src 'self'; "
                 "connect-src 'self'; "
-                "frame-ancestors 'none'"
+                "frame-ancestors 'self'"
             )
 
         # Remove server header info
diff --git a/waf/internal/proxy/proxy.go b/waf/internal/proxy/proxy.go
index 424b4d7..bacd0a4 100644
--- a/waf/internal/proxy/proxy.go
+++ b/waf/internal/proxy/proxy.go
@@ -64,7 +64,8 @@ func New(upstream string, waf *engine.Engine) (*Proxy, error) {
 // CSP 暂保留 unsafe-inline：forgot.html 与 games/*.html 含内联脚本。
 // HSTS 半年期、不含子域，站点全量 HTTPS 后可按需收紧。
 func setSecurityHeaders(h http.Header) {
-	h.Set("X-Frame-Options", "DENY")
+	// SAMEORIGIN：允许本站 iframe 嵌套（登录页条例弹窗），仍防跨站点击劫持
+	h.Set("X-Frame-Options", "SAMEORIGIN")
 	h.Set("X-Content-Type-Options", "nosniff")
 	h.Set("X-XSS-Protection", "1; mode=block")
 	h.Set("Referrer-Policy", "strict-origin-when-cross-origin")
@@ -72,7 +73,7 @@ func setSecurityHeaders(h http.Header) {
 	h.Set("Strict-Transport-Security", "max-age=15552000")
 	h.Set("Content-Security-Policy",
 		"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; "+
-			"img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'")
+			"img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; frame-ancestors 'self'")
 }
 
 // ServeHTTP 实现 http.Handler。