Clickjacking
How Clickjacking Works
Clickjacking is an attack in which a visitor is tricked into clicking something on a page they cannot see. The attacker places a real website inside a frame on their own page. A frame is an HTML element that embeds one page within another. The frame is made transparent or disguised, and the attacker lines up a convincing button over a hidden button on the framed site.
The visitor believes they are clicking a harmless item, such as a play button or a continue link. In reality, the click lands on a control in the other site, such as a confirm button on a settings page. If the visitor is signed in to that site, the action runs with the visitor's own permissions.
How Frame-Blocking Headers Stop the Attack
Clickjacking depends on a browser loading the target site inside a frame on another domain. Sites can stop this by telling browsers not to display them in frames, or only to display them in frames from the same site. Two HTTP response headers do this:
- X-Frame-Options is the older header. It accepts the values
DENYandSAMEORIGINand is supported by widely used browsers. - frame-ancestors is a directive in the Content Security Policy header. It lists the origins allowed to frame the page and is more flexible. Where both are present, modern browsers give priority to frame-ancestors.
Some sites rely on JavaScript that tries to break out of frames. This is unreliable, because the framing page can often limit what that code is able to do. Header-based controls are the dependable approach. The wider set of response headers is covered in HTTP security headers.
A Clickjacking Scenario on a Small Business Site
A small business owner is signed in to the site's admin panel in one browser tab. In another tab, the owner opens an article with a "Play video" button. Hidden beneath that button is the panel's button for saving a change to the account's email address. The owner clicks, and the change is saved without the owner noticing the framed page at all.
The site had no frame-blocking header, so the browser displayed the admin panel inside the attacker's page. Sending the correct header would have stopped the panel from loading in a frame at all.
Frequently asked questions
Is clickjacking the same as cross-site request forgery?
They are related, because both abuse a visitor's signed-in session, but the mechanics differ. Clickjacking relies on a real click on a disguised frame. CSRF sends a forged request without the user seeing a frame at all. Frame-blocking headers stop clickjacking, while anti-CSRF tokens and SameSite cookies stop CSRF. Each defence targets its own attack.
Can clickjacking affect a site that has no login?
It can, although the damage is usually smaller. Attackers can use a frame to trick visitors into clicking ads, accepting browser prompts or submitting forms that do not require an account. Because the framed page is real, the attack can look convincing. A site with no login should still send frame-blocking headers, since the cost is low.