What is Clickjacking and How to Prevent It

Clickjacking is an attack where a malicious site loads your page inside an invisible iframe and overlays it with their own buttons. Victims think they're clicking the attacker's page but are actually clicking yours — approving a payment, changing a setting, or deleting data without realizing it.

How attackers do it

They embed https://yourbank.com in a transparent iframe positioned over a fake "Claim your prize" button. The victim's click passes through to the real, logged-in session.

The fix is one header

Tell browsers your page may not be framed by other origins:

X-Frame-Options: SAMEORIGIN

And the modern equivalent, which is more flexible:

Content-Security-Policy: frame-ancestors 'self'

Use DENY / frame-ancestors 'none' if your pages should never be framed at all.

Verify

After deploying, try embedding your page in a test iframe — the browser should refuse. VitalSite flags missing or weak X-Frame-Options on every page it scans.