Quick answer: Clickjacking is when an attacker embeds a trusted site invisibly into their own malicious page and makes the user click on that site without realizing it. The user thinks they are clicking a button or image, but in reality they approve an action on another site hidden below: a payment, granting a permission, an account setting change. This attack uses the user's open session and trust. The basic defense is to prevent your site from being framed by other pages, using the X-Frame-Options and Content-Security-Policy frame-ancestors headers.

Clickjacking is a sneaky attack that can work without a flaw in your site's code, because the problem is that your page can be framed by someone else. It belongs to the attack family that abuses the user session like CSRF, but relies on visual deception. This article explains how clickjacking works, its real impact and how it is prevented with a one line header.

How clickjacking works

The attacker follows these steps:

  1. Loads the target trusted site inside a frame on a page under their control.
  2. Makes this frame transparent or positions it carefully; the user does not see it.
  3. Puts attractive content on top: a button like "Claim the prize" or "Play the video."
  4. While the user thinks they click the visible button, the click goes to the real button of the invisible site below.

If the user already has an open session on that target site, the click is accepted as a real and authorized action. The key point: the attacker does not break your site, they make it part of a trap.

Clickjacking types and impact

Type How Example impact
Classic transparent frame Clicking an invisible frame Unauthorized action approval
Likejacking Stealing a social media like Unintended sharing
Cursorjacking Misleading the cursor position Clicking the wrong element
Double click trap Sliding the confirm window Stealing a permission grant

The impact depends on what the target site does. It could be a transfer approval on a bank, a permission grant on an admin panel, a privacy setting change on a social network. The user never knows what they did.

Proper defense

1. Prevent framing

The most effective and definitive defense is to prevent your site from being framed by other pages, server side. Two headers do this:

  • X-Frame-Options. With the DENY value it prevents your site from being framed anywhere. An older but widely supported header.
  • Content-Security-Policy frame-ancestors. The modern and flexible method. You specify that only sources you allow may frame your site, or that none may.

These headers tell the browser "do not show this page inside a frame" and cut clickjacking at the root.

2. Extra confirmation for critical actions

Requiring an extra verification step for sensitive actions like transfers or permission grants prevents a single stolen click from completing the action.

3. Manage security headers as a whole

Clickjacking defense is part of the security misconfiguration topic. Security headers must be applied consistently and completely across the whole site.

Security header scanning with KAOS

We detect endpoints exposed to clickjacking at scale with KAOS, DSET's AI powered autonomous security scanning engine. KAOS scans whether the X-Frame-Options and Content-Security-Policy frame-ancestors headers exist and are correctly configured across all your pages; when it finds missing or weak protection it verifies this with a controlled framing attempt and reports only pages that can actually be framed. So you see which pages are left unprotected without false positive noise. KAOS works alongside the human expert and documents every finding with a working proof.

Frequently asked questions

Is clickjacking a flaw in my site's code? No. The problem is that your page can be framed by someone else. When you prevent this with a header, the attack does not work.

Do I need both X-Frame-Options and CSP frame-ancestors? For modern browsers CSP frame-ancestors is enough, but using it together with X-Frame-Options for older browser support is a common and safe approach.

Can clickjacking steal data? It does not read data directly; it makes the user perform an action unknowingly. But if that action is a permission grant or setting change, it can indirectly lead to account takeover.

Are mobile apps affected? Classic clickjacking relies on browser framing. Similar interface deceptions can exist in mobile apps, but the mechanism differs.

Sources

To test your site's clickjacking and security header configuration with KAOS and our expert team, contact DSET. From our Ankara Hacettepe Teknokent laboratory we provide penetration testing and secure code review.