This page attempts to frame Mutillidae. If it succeeds, we have a defect in our code.
Are we being framed?
Hint: Toggle through the security levels. What happens at security level 5?
Is there a new HTTP header at security level 5? Burp-Suite might be useful.