Clickjacking hides your real page inside an invisible frame on an attacker's site. The user thinks they are clicking the attacker's content, but they are actually clicking buttons on your page, such as "delete account" or "confirm payment".

How it happens

If your pages can be loaded in a frame by any website, an attacker can layer them under a decoy page and line up the clicks. It needs no bug in your code, only a missing header.

Why it matters

• Unwanted actions performed by logged-in users.
• Changed settings, approved permissions or triggered payments.
• Abuse of one-click features such as "follow" or "like".

How to prevent it

• Send Content-Security-Policy: frame-ancestors 'self' (or 'none').
• Also send X-Frame-Options: DENY or SAMEORIGIN for older browsers.
• Require confirmation for sensitive actions.

How Vooki Pro helps

• Tests pages for clickjacking.
• Checks X-Frame-Options and CSP, including frame-ancestors.
• Also covers related client-side issues such as reverse tabnabbing and unsafe postMessage handling.
• Reports the affected pages so you can fix them centrally.

Frequently asked questions

Should I use X-Frame-Options or frame-ancestors?

Use CSP frame-ancestors as the modern control and keep X-Frame-Options for older browsers.

Which pages need clickjacking protection?

All pages that perform actions for a logged-in user. Most sites simply apply it to every page.

Related: API keys and secrets in front-end code · Rate limiting and denial-of-service protection