diff --git a/r2/r2/controllers/front.py b/r2/r2/controllers/front.py
index f2f7df902..38aa43bee 100755
--- a/r2/r2/controllers/front.py
+++ b/r2/r2/controllers/front.py
@@ -1182,6 +1182,7 @@ class FormsController(RedditController):
         return BoringPage(_("reset password"),
                           content=ResetPassword(key=key, done=done)).render()
 
+    @prevent_framing_and_css()
     @validate(VUser(),
               location=nop("location"))
     def GET_prefs(self, location=''):