I think there’s an issue with fcc code checking on this problem. app.use(helmet.frameguard({ action: 'deny' }));
should cover both conditions to pass this test
helmet.frameguard() middleware should be mounted correctly
helmet.frameguard() 'action' should be set to 'DENY'
This problem, was noted 3 years ago on the link below and we are now in 2023, and no fix on it.