What Is Clickjacking and How Does X-Frame-Options Prevent It?
Clickjacking tricks users into clicking on hidden elements overlaid on a legitimate page. The X-Frame-Options header and CSP frame-ancestors directive prevent this attack.
ProfitTool Team
Security & Dev
How Clickjacking Works
An attacker creates a malicious page that embeds your website in a transparent <iframe>. The malicious page places a convincing but fake UI element (a button, form, or image) underneath the transparent iframe. When the user clicks what appears to be the fake element, they are actually clicking on your website.
Targets often include: "Delete account" buttons, payment confirmations, privacy setting changes, or OAuth authorisation prompts.
X-Frame-Options
X-Frame-Options: DENY
X-Frame-Options: SAMEORIGIN- DENY: the page cannot be embedded in any iframe, regardless of origin
- SAMEORIGIN: only the same origin can embed the page
- ~~ALLOW-FROM~~: obsolete, removed from most browsers
X-Frame-Options is simple but has limitations — it only accepts a single origin value and is not supported in all contexts.
CSP frame-ancestors (Modern Alternative)
Content-Security-Policy: frame-ancestors 'none'
Content-Security-Policy: frame-ancestors 'self'
Content-Security-Policy: frame-ancestors 'self' https://trusted-partner.comframe-ancestors is more flexible than X-Frame-Options — it supports multiple origins and is the recommended approach. When both are present, CSP frame-ancestors takes precedence.
When Embedding Is Legitimate
Some pages are intentionally embeddable (widgets, maps, video players). In those cases:
- Do not set
X-Frame-Optionsor setframe-ancestorsto only trusted origins - Use framebusting JavaScript as a defence-in-depth measure
- Implement CSRF tokens on any sensitive actions
Testing Your Configuration
Check whether your security headers are correctly configured with our Security Headers Checker.
ProfitTool Team
Security & DevWritten and maintained by the ProfitTool team. Where an article references a ProfitTool utility, the behaviour described is the behaviour of the tool on this site — you can open it and check the output yourself.
More from the Knowledge Hub
HTTP Security Headers Explained: HSTS, CSP, X-Frame-Options and More
HTTP security headers are directives your web server sends to browsers to prevent common attacks like XSS, clickjacking and protocol downgrade. Here is what each one does.
Privacy & SecurityContent Security Policy (CSP) Explained: How to Prevent XSS
A CSP header tells the browser which scripts, styles and resources it may load, which is what blunts XSS. Directives, nonces, and how to roll one out safely.
Privacy & SecurityWhat Is HSTS and Why Does Your Website Need It?
HTTP Strict Transport Security (HSTS) forces browsers to always use HTTPS for your domain, preventing protocol downgrade attacks and mixed-content issues.