App must set security headers to protect against clickjacking

I need assistance in resolving an error I’m experiencing. Despite following the instructions provided by Shopify, my app has been rejected. I have attempted this process five times, but each time I encounter the same issue. It’s worth mentioning that I developed the app using CodeIgniter 3.

Thank you in advance!

Hi @DelightCart

Building and making adjustments for Shopify Apps to get approval from Shopify is a big challenge.

Our team at FoxEcom just went through that, and it was not at all easy. Lots of sleepless nights and all-nighters were involved T_T

Usually, Shopify would leave detailed feedback on why they think the app is not ready. It’s best practice to follow through and resolve all their comments, as well as double-check your app offerings with their guidelines to make sure everything’s good.

To help you better with this, can you share more specifically what are their feedbacks for rejection?

Feel free to connect with me on Twitter @vianingrowth if you don’t feel comfortable sharing details here :slightly_smiling_face:

Cheers,

@vian_FoxEcom

App must set security headers to protect against clickjacking.
To prevent clickjacking attacks, your app must set the proper content security policy directive. If your app is not embedded in an Iframe in the Shopify admin, and you are seeing this message, check your app’s settings and make sure it is set to “non-embedded.” If your app is embedded, then we expect the ‘Content-Security-Policy’ header to be frame-ancestors https://admin.shopify.com https://[shop].myshopify.com, where [shop] is dynamically set to the shop domain the app is embedded on.