diff --git a/SECURITY_AUDIT.md b/SECURITY_AUDIT.md
index 9b251d2a..eafd94e9 100644
--- a/SECURITY_AUDIT.md
+++ b/SECURITY_AUDIT.md
@@ -727,7 +727,7 @@ All security headers are configurable via environment variables:
 - `SECURITY_AUDIT.md` - Updated infrastructure security status
 
 **Tests:**
-- `tests/test_security_headers.py` - Comprehensive test suite (24 tests)
+- `tests/test_security_headers.py` - Comprehensive test suite (11 tests)
   - Unit tests for individual headers
   - Integration tests for configuration loading
   - Security tests for header format validation
diff --git a/docs/ConfigurationGuide.md b/docs/ConfigurationGuide.md
index ae2cbf0b..5a8b503a 100644
--- a/docs/ConfigurationGuide.md
+++ b/docs/ConfigurationGuide.md
@@ -159,7 +159,7 @@ Prevents the page from being loaded in frames/iframes. Protects against clickjac
 **Valid Values:**
 - `DENY` - Page cannot be displayed in a frame (most secure)
 - `SAMEORIGIN` - Page can only be displayed in a frame on the same origin
-- `ALLOW-FROM uri` - Page can only be displayed in a frame on the specified origin (deprecated in modern browsers)
+- ~~`ALLOW-FROM uri`~~ - **Deprecated**: Page can only be displayed in a frame on the specified origin. This directive is deprecated in modern browsers; use CSP `frame-ancestors` directive instead.
 
 #### X-Content-Type-Options
 
diff --git a/tests/test_security_headers.py b/tests/test_security_headers.py
index 11e865cd..821e0f86 100644
--- a/tests/test_security_headers.py
+++ b/tests/test_security_headers.py
@@ -141,6 +141,7 @@ def test_x_frame_options_valid_value(client):
     if "X-Frame-Options" in response.headers:
         x_frame_value = response.headers["X-Frame-Options"]
         valid_values = ["DENY", "SAMEORIGIN"]
+        # Note: ALLOW-FROM is deprecated in modern browsers; use CSP frame-ancestors instead
         assert x_frame_value in valid_values or x_frame_value.startswith(
             "ALLOW-FROM"
         ), f"Invalid X-Frame-Options value: {x_frame_value}"