Clickjacking is an attack in which a malicious page loads a target site in a transparent or disguised frame and positions it over a decoy button. The user believes they are clicking something harmless, but the click lands on a control in the hidden page, such as "delete account" or "confirm payment".
Why it matters
The victim's own browser session, with its cookies, performs the action, so no password needs to be stolen. The defence is for sites to control who may frame their pages. Two mechanisms do this: the X-Frame-Options header and the frame-ancestors directive of a Content Security Policy.
Example
A site that should never appear inside another page sends these headers:
X-Frame-Options: DENY
Content-Security-Policy: frame-ancestors 'none'Browsers that honour them refuse to render the page inside an iframe on another origin, so the overlay trick fails.
Common mistakes
- Sending no framing policy on pages with sensitive actions.
- Using only the obsolete
ALLOW-FROMvalue of X-Frame-Options, which modern browsers ignore. - Allowing broad framing for convenience when only one partner needs it.
- Relying on JavaScript frame-busting code, which can be bypassed.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.