Imagine a visitor lands on a harmless-looking page, clicks what looks like a "Play" button — and unknowingly clicks "Delete account" or "Confirm payment" on your website instead. That is clickjacking, and it works because your site can be loaded inside an invisible frame on someone else's page.
Attackers embed your site in a transparent iframe, then layer their own tempting buttons, images, or fake pop-ups on top. The visitor thinks they are clicking the visible page, but every click actually lands on your site, in their logged-in session. The result can be changed settings, unwanted actions, or stolen interactions — all without any malware on your site at all.
The fix is refreshingly simple, and it lives on your server, not in your visitors' browsers. Send the X-Frame-Options header with the value DENY or SAMEORIGIN, or better, use a Content Security Policy frame-ancestors directive (for example, frame-ancestors 'self'). Either setting tells browsers not to let other sites frame your pages, which breaks the attack at its root.
Check three things this week. First, test whether your homepage and login pages can be framed at all — if they load inside another site's frame, you are exposed. Second, confirm the header is present on every important page, not just the homepage: login, account, checkout, and admin pages matter most. Third, if you use a plugin or service that legitimately needs framing, allow only that trusted origin instead of opening framing to everyone.
Clickjacking is quiet, cheap to attempt, and easy to prevent. A single header turns an invisible trap into a closed door.
Run a free check of your site's exposure at https://vulnerabilitytools.com/ and make sure framing protection is part of your regular security routine.
Top comments (0)