← All articles

What Is Clickjacking? Invisible Click Attacks and frame-ancestors Protection

9 September 2026

What Is Clickjacking? Invisible Click Attacks and frame-ancestors Protection

Clickjacking makes a user click something different from what they see. The attacker embeds your site in an invisible iframe on their own page and places an enticing button (“Claim your prize”) over it. The user thinks they click that button; in reality they click a real function on your site inside the iframe (e.g., “authorize,” “follow,” “delete”).

How the attack is built

  1. The attacker loads your site in an <iframe> on their page.
  2. With CSS they make the iframe transparent (opacity: 0) and align it exactly where the user will click.
  3. They place tempting content beneath it. The user clicks the visible content; the click lands on the transparent iframe — the real button on your site.

If the user is logged in, the action runs with their identity. So clickjacking is dangerous on one-click state-changing actions.

Modern protection: frame-ancestors

The strongest defence today is the Content-Security-Policy frame-ancestors directive, which controls which origins may embed your site in an iframe:

Content-Security-Policy: frame-ancestors 'none';
  • 'none': your site cannot be embedded anywhere (the safest default).
  • 'self': only your own origin may embed it.
  • frame-ancestors https://trusted.example: only the listed origin may embed it.

Legacy protection: X-Frame-Options

Before frame-ancestors, the header was X-Frame-Options (DENY or SAMEORIGIN). In modern browsers CSP frame-ancestors supersedes it and is more flexible, but sending both is harmless for very old clients. Note: X-Frame-Options: ALLOW-FROM is no longer reliably supported; use frame-ancestors to allow multiple origins.

Recommendations

  1. Use frame-ancestors 'none' on all pages that need not be embedded — this should be the default for admin panels and state-changing pages.
  2. For pages that genuinely need embedding (widgets), allow only trusted origins.
  3. Add extra confirmation (re-authentication) for critical actions.

Summary

Clickjacking steals the user’s click through an invisible iframe. The fix is simple and effective: strictly limit where your site can be embedded with Content-Security-Policy: frame-ancestors (with X-Frame-Options alongside for old clients). Pages that need not be embedded should default to frame-ancestors 'none'.

Sources: MDN: frame-ancestors, OWASP Clickjacking Defense Cheat Sheet.

Does your site send the right anti-clickjacking headers? CyberTestify’s scan checks for missing security headers across your external surface.