X-Frame-Options is present
The response includes X-Frame-Options.
Why it matters
This header tells older browsers whether other sites may frame the page.
What to do
Prefer CSP frame-ancestors as well. ALLOW-FROM is ignored; only DENY and SAMEORIGIN count.
Reference
Only DENY and SAMEORIGIN are honored; ALLOW-FROM is obsolete.