Clickjacking is an attack where malicious actors trick users into clicking something different from what they perceive, often by overlaying transparent elements over legitimate buttons or links. This can lead to unwanted actions, data theft, or malware installation. To prevent clickjacking, developers implement frame-busting code and use security headers like X-Frame-Options or CSP frame-ancestors to control how their pages can be embedded in iframes.
Clickjacking, a form of UI redressing, tricks a user into interacting with a page they cannot see. The attacker loads a legitimate target site inside an invisible or near-transparent iframe and positions it over decoy content, so a button the user believes they are clicking actually lands on a control in the framed page, confirming a payment, changing a setting, granting a permission. Variants include dragging content into hidden fields, hijacking cursor position, or overlaying fake prompts. The victim is genuinely authenticated on the target site, so every click carries their real session and privileges. Nothing is technically injected into the target; the deception is purely visual layering.
Because the framed application receives authentic, authenticated clicks, clickjacking can trigger state-changing actions that the user never intended: transferring funds, deleting data, approving an OAuth scope, following an account, or toggling a security setting. It sidesteps input validation and even multi-factor authentication, since the user is already logged in and voluntarily clicking. It also composes with other tricks, likejacking on social platforms and cursorjacking that steals keystrokes into hidden inputs. Any page that performs a sensitive one-click action and can be embedded in a frame is a candidate, which makes it a broad risk for banking, admin panels, and account settings pages.
The reliable defenses are server-set response headers that tell the browser not to render your page in someone else's frame. Send Content-Security-Policy frame-ancestors with an explicit allowlist (or 'none'), and set X-Frame-Options: DENY or SAMEORIGIN for older clients; frame-ancestors supersedes X-Frame-Options where both apply. Legacy JavaScript frame-busting is a weaker fallback that attackers can neutralize. For sensitive actions, add confirmation steps that resist blind clicking. Because these headers are part of a page's secure-header posture, cside's monitoring can flag when a third-party script or misconfiguration strips or weakens them, helping ensure framing protections stay in place in production.
XSS injects and runs attacker code inside your page's origin. Clickjacking injects no code at all; it visually overlays your real page inside a hidden frame so the user's genuine clicks hit controls they cannot see. XSS abuses code execution, clickjacking abuses the interface and the user's trust in what they are clicking.
No. HTTPS encrypts traffic and authenticates the server, but it does nothing to stop your page from being embedded in a malicious frame. Clickjacking is defeated by framing controls such as the CSP frame-ancestors directive and X-Frame-Options, not by transport encryption.
We answer client-side security questions every day. Bring yours.