X-Frame-Options is obsolete
X-Frame-Options uses a value browsers no longer honor, such as ALLOW-FROM.
Why it matters
The page can still be framed. The obsolete value does not create an allowlist.
What to do
Use DENY or SAMEORIGIN, and set CSP frame-ancestors for the hosts that may embed the page.
Reference
Only DENY and SAMEORIGIN are honored; ALLOW-FROM is obsolete.