I am using the classic universal login and wasn’t sure if I needed to turn migrations on to prevent clickjacking. I think I’m getting confused if it needs to be enabled or not because of this link.
If you want clickjacking protection, leave the toggle off. If you don’t (or need to load in an iframe) then you will want to toggle it on and therefore forego the security headers.
You should be able to see any security headers in the network tab if you choose a specific request and then “headers”.