After a pen test a low impact security flaw was reported saying that X-FRAME-OPTIONS were not being set. Which was odd as following the devdocs recommendation (https://devdocs.magento.com/guides/v2.2/config-guide/secy/secy-xframe.html) we were getting the following in the header of every page.
The pen testers came back to say that the /soap page wasn't showing this header. So checked with
curl -I --location-trusted https://website-url/soap
and they were right that the header wasn't set on this page (don't know of any others). Navigating to the page opens an xml doc, so is there an additional setting to add the header for this page, this type of page or another change we can make?