Cybersecurity glossary
What is Clickjacking?
Learn what clickjacking is, how UI redressing tricks users into clicking hidden actions, which headers like CSP frame-ancestors and X-Frame-Options help, and how to test framing defenses.
Definition
Clickjacking is a UI redressing attack in which an adversary overlays or embeds a legitimate page so that a victim’s clicks or taps are hijacked to perform unintended actions on a trusted site while the user believes they are interacting with something else.
Why clickjacking matters
Users trust what they see. Clickjacking exploits that trust by separating visible UI from the actual element receiving the click. A victim may think they are starting a video or dismissing a banner, while the real click confirms a money transfer, enables a webcam permission, changes email settings, or follows an attacker-controlled account.
The attack is attractive because it abuses legitimate authenticated sessions. The browser sends real cookies and performs a real user gesture. That makes purely server-side “was this request forged?” checks harder unless the sensitive action also requires intentional confirmation patterns beyond a single click.
How clickjacking works
Most web clickjacking uses framing plus visual deception.
Find a sensitive click target
Locate authenticated actions that can be triggered with a single click or tap on a framed page.
Embed the victim page
Place the trusted page in an iframe on an attacker-controlled site, if framing is allowed.
Obscure the real UI
Use opacity, overlays, overlapping elements, or carefully positioned decoys so the victim sees a different interface.
Lure an interaction
Social engineering convinces the user to click where the hidden sensitive control sits.
Execute the real action
The trusted site receives a genuine click in the user’s session and performs the unintended operation.
Hide evidence
The attacker page may navigate away or show benign content after the hijacked click.
Variants include nested frames, drag-and-drop redressing, and partial overlays. The constant is mismatch between perceived and actual UI targets.
Impact examples
Account settings changes
Email, MFA, OAuth grants, or privacy settings flipped by a disguised click.
Social and approval actions
Follows, likes, shares, or workflow approvals performed without informed consent.
Financial and commerce actions
Purchases, transfers, or payout destination changes triggered through redressing.
Permission prompts
Browser or site permission dialogs aligned under fake buttons to gain camera, mic, or notifications.
Primary defenses
Prevent untrusted embedding of sensitive pages. Prefer modern CSP, keep legacy headers for defense in depth, and design critical actions to resist single-click abuse.
| Control | Role | Notes |
|---|---|---|
| CSP frame-ancestors | Allowlist which parents may embed the page | Preferred modern framing defense |
| X-Frame-Options | DENY or SAMEORIGIN framing restriction | Still useful for older clients |
| User confirmation UX | Re-auth or typed confirmation for high-risk actions | Raises cost beyond one hijacked click |
| JS frame busting | Historical attempt to break out of frames | Unreliable alone; do not depend on it |
Implementation checklist
- Set Content-Security-Policy with frame-ancestors 'none' or an explicit trusted allowlist on sensitive responses.
- Add X-Frame-Options: DENY or SAMEORIGIN as compatible secondary protection.
- Verify headers on HTML pages, not only on API JSON responses that are never framed.
- Cover CDN, reverse-proxy, and legacy hostnames that serve the same UI.
- Allow framing only for deliberate embed use cases with least-privilege parent origins.
- Require step-up authentication or explicit confirmation for irreversible account and money actions.
- Test with an external page that tries to iframe logout, settings, and admin controls.
- Avoid relying solely on client-side frame-busting scripts.
Testing tip
Create a simple external HTML page with an iframe pointing at a sensitive URL while authenticated. If the browser shows an empty frame or console framing error and your headers are present, the baseline control works. Repeat for mobile webviews and alternate domains.
The practical takeaway
Clickjacking steals user intent by making a trusted page receive clicks meant for something else. The durable web defense is to control who can embed your pages—primarily with CSP frame-ancestors, supported by X-Frame-Options—and to harden high-impact actions against single-click abuse.
If a sensitive screen can be framed by an arbitrary origin, assume attackers will try to put their UI on top of yours.
Related security terms
Content Security Policy (CSP)
Modern framing control via the frame-ancestors directive is a primary clickjacking defense.
X-Frame-Options
A legacy HTTP header that restricts which sites may embed a page in a frame.
Cross-Site Request Forgery (CSRF)
Another cross-site interaction abuse class; often discussed alongside framing attacks.
Same-Origin Policy (SOP)
The browser security model that framing defenses extend for embedded documents.
Frequently asked questions
What is clickjacking in simple terms?
Clickjacking tricks someone into clicking a real button on a trusted website while they think they are clicking something else. Attackers often hide the real page in a transparent iframe under fake UI.
Is clickjacking the same as CSRF?
No. CSRF forges a request using the victim’s cookies without needing a precise click on the victim page UI. Clickjacking abuses the victim’s genuine click on an embedded trusted page. Sites often need defenses for both.
How do you prevent clickjacking?
Disallow unwanted embedding with Content-Security-Policy frame-ancestors and, for broader compatibility, X-Frame-Options. Avoid relying only on JavaScript frame-busting scripts.
Does SameSite cookies stop clickjacking?
SameSite primarily helps with cross-site request behavior. Clickjacking uses the user’s real interaction with a framed page, so framing controls remain necessary.
Can mobile apps be clickjacked?
Similar overlay and tapjacking issues exist on some mobile UI stacks. Web clickjacking specifically focuses on browser framing, but mobile apps need their own overlay protections.
When is framing still legitimate?
Payment widgets, SSO embeds, and partner portals may require controlled framing. Use an allowlist of trusted parents in CSP frame-ancestors rather than opening framing to the entire internet.
How can teams test for clickjacking?
Attempt to embed sensitive pages in an external HTML iframe and confirm the browser blocks framing. Also verify header presence on redirects, CDNs, and alternate hostnames.
References
Explore authoritative guidance and frameworks related to clickjacking.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.