Skip to main content
Threat playbook

Category: Web Exploits

Clickjacking

Clickjacking hides a real page under a decoy. Your click lands on a hidden button.

The hidden button can confirm a payment or permission. Site owners stop it by blocking framing. Send a CSP frame-ancestors directive. Add X-Frame-Options for older browsers.

The click is real, so logs look normal. Malware scanners have nothing to catch.

Updated 2026-10-30

How does clickjacking work?

OWASP calls clickjacking a UI redress attack. Transparent or opaque layers trick you into clicking something else.

For background-tab tricks, see tabnabbing.

  1. A malicious page frames a real site, hidden from view.
  2. It shows a decoy button, like Play or Close.
  3. Your click passes through to the hidden site's button.
  4. The real site sees a signed-in user approving an action.

How do you prevent clickjacking with CSP frame-ancestors?

Tell browsers which sites may frame your pages. OWASP recommends frame-ancestors 'none' unless you need framing. Use 'self' to allow only your own site. It does not work in a meta tag, per MDN.

Response headers that block framing
# Block all framing
Content-Security-Policy: frame-ancestors 'none'
X-Frame-Options: DENY

# Allow only your own origin
Content-Security-Policy: frame-ancestors 'self'
X-Frame-Options: SAMEORIGIN

Is X-Frame-Options still needed?

Only as a fallback for older browsers. OWASP says frame-ancestors made X-Frame-Options obsolete. Browsers that enforce frame-ancestors ignore X-Frame-Options. The ALLOW-FROM value no longer works in modern browsers.

How do you test your site for clickjacking?

  1. Create a local HTML file with an iframe.
  2. Point the iframe at a sensitive page on your site.
  3. Open the file in a current browser.
  4. If the page renders in the frame, it is exposed.
  5. Repeat for sign-in, settings, and payment pages.
Minimal framing test page
<!doctype html>
<title>Framing test</title>
<iframe src="https://example.com/account/settings" width="800" height="600"></iframe>

How is clickjacking different from XSS, CSRF, and formjacking?

All four attacks abuse a browser you trust. Visitors can do little about them. The site under attack must fix each one. PCI DSS 6.4.3 and 11.6.1 target payment page skimming. They require authorized, integrity-checked, and monitored scripts.

Site-side web attacks compared. The attacked site fixes each one, not the visitor.
AttackWhat it abusesWho fixes itMain control
ClickjackingYour click, through a hidden frameThe framed siteCSP frame-ancestors
Cross-site scripting (XSS)Injected script running as the trusted siteThe vulnerable siteOutput encoding and sanitization, per OWASP
Cross-site request forgery (CSRF)Your signed-in browser sending a forged requestThe target siteCSRF tokens, with SameSite cookies as backup, per OWASP
Formjacking (web skimming)Injected script copying form fieldsThe site and its script vendorsScript inventory, Subresource Integrity, and tamper alerts

Site-side web attacks compared. The attacked site fixes each one, not the visitor.

Why do security tools miss clickjacking?

  • No malware runs, so endpoint tools see nothing.
  • The click is genuine, so logs look normal.
  • Some sites still send no anti-framing header.

What should site owners check?

  • Send frame-ancestors 'none' unless you need framing.
  • Name only trusted origins when you do need it.
  • Keep X-Frame-Options as a fallback for old browsers.
  • Require re-authentication for payments and security changes.
  • Re-test framing after CDN or header changes.
  • Treat OAuth grants and permission prompts as high risk.

Does browser isolation stop clickjacking?

  • Clickjacking is fixed by a header on the framed site.
  • Shield opens a page in an isolated browser off your device.
  • That changes where a page runs, not what you click.
Add to Chrome

Limits

  • Header advice applies to sites you control.
  • The table reduces each attack to its main control.
  • Sources were checked on October 30, 2026.
  • Legba publishes this guide. Shield is part of Legba's Chrome extension.

FAQs.

Is clickjacking still possible in modern browsers?
Yes, on sites that allow framing. A frame-ancestors policy closes the gap.
How do websites prevent clickjacking?
They send CSP frame-ancestors 'none' or 'self'. X-Frame-Options DENY covers older browsers. Sensitive actions should also require re-authentication.
What is the difference between clickjacking and CSRF?
Clickjacking hijacks your real click. CSRF forges a request without one. Both abuse your signed-in session.
How do I test my site for clickjacking?
Frame a sensitive page from a local test file. If it renders, the page can be framed.
Does browser isolation stop clickjacking?
No, anti-framing headers on the target site are the fix.
Can I set frame-ancestors in a meta tag?
No, the directive does not work in a meta tag. Send it as an HTTP response header.
Does SameSite stop clickjacking?
Not on its own. OWASP treats SameSite cookies as defense in depth. Framing controls are still required.
What actions are most at risk?
OAuth grants, permission prompts, payments, and security settings.

References

  1. 01
    OWASP: ClickjackingOWASP
  2. 02
    OWASP Cheat Sheet Series: Clickjacking DefenseOWASP
  3. 03
    MDN: Content-Security-Policy: frame-ancestors directiveMozilla
  4. 04
    OWASP: Cross Site Scripting (XSS)OWASP
  5. 05
    OWASP: Cross Site Request Forgery (CSRF)OWASP
  6. 06
    PCI Security Standards Council: Payment Page Security and Preventing E-SkimmingPCI SSC

Keep exploring

Try it on the next page you do not trust

Legba is a Chrome extension with two modes. Ghost gives you a private browser route. Shield opens a page in an isolated browser off your device.

Add to Chrome

Free for 30 days. No card required.

Ghost. A private route for your browser. Shield. An isolated browser, off your device. Choose the mode. Close when finished.