{
    "title": "Clickjacking",
    "seo_title": "Clickjacking: definition, example and prevention",
    "h1": "Clickjacking",
    "description": "Clickjacking explained: how an invisible frame hijacks your clicks, and how to block it with frame-ancestors and X-Frame-Options on a WordPress site.",
    "lead": "Clickjacking means displaying a legitimate site in an invisible frame layered over a booby-trapped page: the victim thinks they are clicking a harmless button but actually triggers an action on the hidden site, with their own session. The frame-ancestors and X-Frame-Options headers prevent it.",
    "language": "en",
    "locale": "en-US",
    "type": "definition",
    "url": "https://www.wp-masquerade.com/glossary/clickjacking/",
    "canonical": "https://www.wp-masquerade.com/glossary/clickjacking/",
    "markdown": "https://www.wp-masquerade.com/glossary/clickjacking/index.md",
    "json": "https://www.wp-masquerade.com/glossary/clickjacking/index.json",
    "published": "2026-10-28T08:00:00+00:00",
    "modified": "2026-10-28T20:00:08+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "Clickjacking",
            "url": "https://www.wp-masquerade.com/glossary/clickjacking/",
            "markdown": "https://www.wp-masquerade.com/glossary/clickjacking/index.md",
            "json": "https://www.wp-masquerade.com/glossary/clickjacking/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "Clickjacking",
            "url": "https://www.wp-masquerade.com/fr/definitions/clickjacking/",
            "markdown": "https://www.wp-masquerade.com/fr/definitions/clickjacking/index.md",
            "json": "https://www.wp-masquerade.com/fr/definitions/clickjacking/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "Clickjacking",
            "url": "https://www.wp-masquerade.com/es/glosario/clickjacking/",
            "markdown": "https://www.wp-masquerade.com/es/glosario/clickjacking/index.md",
            "json": "https://www.wp-masquerade.com/es/glosario/clickjacking/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "Clickjacking",
            "url": "https://www.wp-masquerade.com/de/glossar/clickjacking/",
            "markdown": "https://www.wp-masquerade.com/de/glossar/clickjacking/index.md",
            "json": "https://www.wp-masquerade.com/de/glossar/clickjacking/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "Clickjacking",
            "url": "https://www.wp-masquerade.com/it/glossario/clickjacking/",
            "markdown": "https://www.wp-masquerade.com/it/glossario/clickjacking/index.md",
            "json": "https://www.wp-masquerade.com/it/glossario/clickjacking/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "Clickjacking",
            "url": "https://www.wp-masquerade.com/pt/glossario/clickjacking/",
            "markdown": "https://www.wp-masquerade.com/pt/glossario/clickjacking/index.md",
            "json": "https://www.wp-masquerade.com/pt/glossario/clickjacking/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "Clickjacking",
            "url": "https://www.wp-masquerade.com/nl/woordenlijst/clickjacking/",
            "markdown": "https://www.wp-masquerade.com/nl/woordenlijst/clickjacking/index.md",
            "json": "https://www.wp-masquerade.com/nl/woordenlijst/clickjacking/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "Clickjacking"
        },
        {
            "level": 2,
            "text": "How clickjacking works"
        },
        {
            "level": 2,
            "text": "How to protect against it"
        },
        {
            "level": 2,
            "text": "For WordPress"
        }
    ],
    "body": "It is also known as a “UI redressing” attack. MITRE classifies it as CWE-1021: the site doesn't restrict, or improperly restricts, being rendered inside frames that belong to another domain. There is no injected code and no stolen password here: the attacker hijacks a click the victim makes themselves, with their own session.\n\n## How clickjacking works\n\nThe attacker creates a page that displays something enticing: a game, a “Continue” button, a fake verification. On top of it, they load the target site in an `<iframe>` made invisible (zero opacity) and place the site's sensitive button exactly under the fake one. If the browser attaches the session cookies to that frame, the logged-in victim triggers the real action: changing an email address, confirming a setting, granting access.\n\n![The four layers of a clickjacking attack: a visible decoy page with a button that lures the click, an invisible frame containing the legitimate site with its sensitive button lined up under the cursor, the victim's session that gives the action its rights if the browser attaches the cookies, and the site's defense with frame-ancestors self or X-Frame-Options SAMEORIGIN, which prevents display in the frame](https://www.wp-masquerade.com/media/2026/10/clickjacking-couches-en.webp)\n\n*Without a header that forbids framing, any site can layer yours over its own page.*\n\n*Video: “What is Clickjacking?” (Hacksplaining)*\n\n## How to protect against it\n\nThe protection is simple and relies on the browser: the site states in its [HTTP security headers](https://www.wp-masquerade.com/glossary/http-security-headers/) who is allowed to display it in a frame.\n\n- **`Content-Security-Policy: frame-ancestors`**: the modern directive of the [Content Security Policy](https://www.wp-masquerade.com/glossary/content-security-policy/). `'none'` forbids any framing, `'self'` only allows the site itself, and you can list specific origins. It is not honored in a `<meta>` tag: it must be sent as an HTTP header.\n- **`X-Frame-Options`**: the older header, still useful for older browsers. It accepts `DENY` or `SAMEORIGIN`; the `ALLOW-FROM` value is obsolete and ignored by modern browsers.\n\nWhen both are present, the CSP specification says to ignore `X-Frame-Options` in favor of `frame-ancestors`; sending both is still recommended. JavaScript “frame-busting” scripts, on the other hand, are easy to bypass and are not enough. `SameSite` cookies also reduce the risk, without preventing framing. Finally, a recent variant, “double clickjacking,” relies on successive windows rather than a frame: headers don't block it, which is why server-side confirmation is worthwhile for the most sensitive actions.\n\n## For WordPress\n\nWordPress already protects its sensitive screens: the `send_frame_options_header()` function, called on the login page and in the admin area, sends `X-Frame-Options: SAMEORIGIN` and, in current versions, `frame-ancestors 'self'`. Public pages, however, get nothing by default. Yet that is where a store's customer account area or profile forms live. You can add the header at the server level, for example in an [.htaccess](https://www.wp-masquerade.com/glossary/htaccess/) file on Apache:\n\n```\n<IfModule mod_headers.c>\n    Header always set X-Frame-Options \"SAMEORIGIN\"\n    Header always set Content-Security-Policy \"frame-ancestors 'self'\"\n</IfModule>\n```\n\nWatch out for an existing CSP: two `Content-Security-Policy` headers are combined, so the directive should then be added to the existing policy. On Nginx, the equivalent is `add_header X-Frame-Options SAMEORIGIN always;`. If you'd rather not touch the server configuration, [WP Masquerade Pro's security headers](https://www.wp-masquerade.com/features/security-headers/) send `X-Frame-Options: SAMEORIGIN` by default across the whole site, without overwriting a header that is already set, while keeping your posts embeddable in other WordPress sites through oEmbed. [Our guide to security headers](https://www.wp-masquerade.com/http-security-headers-wordpress/) covers the other useful headers and how to test them.\n\n## Related terms\n\n- [Content Security Policy (CSP)](https://www.wp-masquerade.com/glossary/content-security-policy/)\n- [HTTP security headers](https://www.wp-masquerade.com/glossary/http-security-headers/)\n- [CSRF (cross-site request forgery)](https://www.wp-masquerade.com/glossary/csrf/)\n- [XSS (cross-site scripting)](https://www.wp-masquerade.com/glossary/xss/)\n- [htaccess file (.htaccess)](https://www.wp-masquerade.com/glossary/htaccess/)\n\n\n## Sources\n\n- [OWASP Cheat Sheet Series : Clickjacking Defense](https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html)\n- [MDN : CSP frame-ancestors](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-ancestors)\n- [MDN : X-Frame-Options](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options)\n- [WordPress Developer Resources : send_frame_options_header()](https://developer.wordpress.org/reference/functions/send_frame_options_header/)",
    "definition": "Clickjacking means displaying a legitimate site in an invisible frame layered over a booby-trapped page: the victim thinks they are clicking a harmless button but actually triggers an action on the hidden site, with their own session. The frame-ancestors and X-Frame-Options headers prevent it.",
    "group": "Web security",
    "aka": [
        "UI redressing",
        "UI redress attack",
        "click hijacking",
        "CWE-1021"
    ],
    "related": [
        {
            "title": "Content Security Policy (CSP)",
            "url": "https://www.wp-masquerade.com/glossary/content-security-policy/",
            "markdown": "https://www.wp-masquerade.com/glossary/content-security-policy/index.md"
        },
        {
            "title": "HTTP security headers",
            "url": "https://www.wp-masquerade.com/glossary/http-security-headers/",
            "markdown": "https://www.wp-masquerade.com/glossary/http-security-headers/index.md"
        },
        {
            "title": "CSRF (cross-site request forgery)",
            "url": "https://www.wp-masquerade.com/glossary/csrf/",
            "markdown": "https://www.wp-masquerade.com/glossary/csrf/index.md"
        },
        {
            "title": "XSS (cross-site scripting)",
            "url": "https://www.wp-masquerade.com/glossary/xss/",
            "markdown": "https://www.wp-masquerade.com/glossary/xss/index.md"
        },
        {
            "title": "htaccess file (.htaccess)",
            "url": "https://www.wp-masquerade.com/glossary/htaccess/",
            "markdown": "https://www.wp-masquerade.com/glossary/htaccess/index.md"
        }
    ],
    "sources": [
        {
            "title": "OWASP Cheat Sheet Series : Clickjacking Defense",
            "url": "https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html"
        },
        {
            "title": "MDN : CSP frame-ancestors",
            "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-ancestors"
        },
        {
            "title": "MDN : X-Frame-Options",
            "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options"
        },
        {
            "title": "WordPress Developer Resources : send_frame_options_header()",
            "url": "https://developer.wordpress.org/reference/functions/send_frame_options_header/"
        }
    ],
    "format": "application/json"
}