X-Frame-Options is invalid
X-Frame-Options is present but is not DENY or SAMEORIGIN.
Why it matters
Browsers ignore an invalid value, so the header does not limit framing.
What to do
Set DENY or SAMEORIGIN.
Reference
Only DENY and SAMEORIGIN are honored; ALLOW-FROM is obsolete.