Clickjacking mitigation

The site prevents other websites from embedding its pages to trick users into clicking.

Impact

About

Clickjacking is a malicious attack where users are tricked into clicking on links or user interface elements on a site that appears to be a trusted and familiar site. This is typically accomplished by embedding part or all of the trusted site into the malicious site using an <iframe>.

The X-Frame-Options (XFO) header and the frame-ancestors directive in the Content-Security-Policy (CSP) header can mitigate clickjacking attacks by controlling how a site can be embedded within an $lt;iframe>.

Risks

Hackers can trick users into clicking wrong things.

Why it's important

Prevents malicious websites from tricking users into clicking hidden elements, enhancing site security and protecting user actions.

User stories

As a user, I want to safely click buttons and links so I'm not tricked into doing something I didn't mean to.

Code

Option 1 — X-Frame-Options header:

X-Frame-Options: DENY

Option 2 — Content Security Policy (preferred):

Content-Security-Policy: frame-ancestors 'none'

Error

ScanGov messaging when a site fails a standard:

Page is not protected from possible clickjacking by containing frames.

Guidance

OWASP Top 10

Indicators

Security