Clickjacking protection

mediumsecurity-clickjacking

Clickjacking loads your site in a hidden iframe to hijack clicks. X-Frame-Options or a CSP frame-ancestors directive stops it — here's how.

What it is

Clickjacking protection stops another site from loading yours inside an invisible <iframe> and tricking a visitor into clicking something they didn't mean to. It's enforced with either the X-Frame-Options header or a Content-Security-Policy frame-ancestors directive.

Either one is sufficient on its own; a page needs at least one to pass this check.

Why it matters

A page with neither can be framed by any origin, then overlaid with a fake button or form the attacker controls. The classic attack tricks a logged-in visitor into an unintended action — a purchase, a permission grant — while they think they're clicking something else entirely.

Setting X-Frame-Options: DENY (or SAMEORIGIN, if the page legitimately needs to be framed by its own origin) is a one-line fix with no functional downside for a page that was never meant to be embedded elsewhere.

How to fix it

with a reference doc

nginx

add_header X-Frame-Options "DENY" always;

.htaccess

Header always set X-Frame-Options "DENY"

next.config.js

async headers() {
  return [{
    source: '/(.*)',
    headers: [{ key: 'X-Frame-Options', value: 'DENY' }]
  }];
}

_headers

/*
  X-Frame-Options: DENY

Reference documentation

Related checks

lowContent-Security-Policy headerContent-Security-Policy (CSP) is an HTTP response header that tells the browser which sources of scripts, styles, images and other resources a page is allowed to load. Anything not on the allow-list is blocked before it runs, regardless of how it got onto the page.lowX-Content-Type-Options headerX-Content-Type-Options: nosniff tells the browser to trust the Content-Type header a server sends and stop guessing a resource's type from its content.mediumStrict-Transport-Security (HSTS) headerStrict-Transport-Security (HSTS) is a response header that tells a browser to only ever connect to this host over HTTPS, for a duration set by max-age, without first trying HTTP.

This is one of the 75 checks the scanner runs. See what we check for the full list, every severity weight, and how the score is computed from them.

What it is

Why it matters

How to fix it

Related checks

See whether your own site passes clickjacking protection.