Skip to content
iframecheck

Clickjacking

Clickjacking is an attack that loads your page in a hidden frame on another site. The visitor thinks they click the visible page, but the click goes to your page.

Security attack

Also called UI redressing

Updated

On this page

How it works

The attacker makes a page with a bait button. Then they load your page in an iframe on top of it, with its opacity set to 0. The frame is invisible, but it still gets the clicks.

If the visitor is signed in to your site, one click can change a setting, send a payment, or delete data. The browser can send the visitor's cookies with the framed page, so the action looks real to your server.

What it needs

The attack works only when the browser lets another site load your page in a frame. A page that sends frame-ancestors 'none' or X-Frame-Options: DENY does not load in the frame, so there is nothing to click.

Cookies with SameSite=Lax or SameSite=Strict also help. The browser does not send them with a page in a frame on another site, so the framed page often shows the visitor as signed out.

Example

  1. 01The visitor sees the bait page and its button.
  2. 02Your page sits on top in an invisible iframe.
  3. 03The click lands on your "Delete account" button.

How to prevent it

Tell browsers which sites may frame your page. Send CSP frame-ancestors. Also send X-Frame-Options for old browsers.

# Only your own site may frame this page
Content-Security-Policy: frame-ancestors 'self'
X-Frame-Options: SAMEORIGIN

# Or: no site may frame this page
Content-Security-Policy: frame-ancestors 'none'
X-Frame-Options: DENY

To allow a partner, list it in frame-ancestors, for example 'self' https://partner.example. X-Frame-Options cannot list sites.

Learn more

Sources

Know before you embed.

Free, no sign-up, nothing stored. Paste a URL and get a verdict, a live preview, and the fix.

Test a URLBrowse guides