What is Clickjacking? How It Works and Prevention

Clickjacking is a web attack that tricks users into clicking something different from what they see, usually by hiding a real button under a fake one. Known formally as UI redressing, it layers an invisible copy of a legitimate page over a decoy, so a click meant for the decoy lands on the hidden control instead. Researchers Robert Hansen and Jeremiah Grossman coined the term in 2008.

The threat is not theoretical. CloudSEK researchers uncovered a live phishing campaign that harvested credentials from 1,262 victims by framing companies' own login pages inside invisible iframes, an attack that worked only because those sites had not set an anti-framing header.

How Does Clickjacking Work?

Clickjacking abuses the iframe, an HTML element that embeds one web page inside another. The attacker loads the target site, such as a bank or webmail login, inside an iframe and overlays it on a decoy page that shows a tempting button like “Win a prize.”

CSS then makes the trap invisible. The attacker sets the iframe's opacity close to zero, turning the real page transparent. Using z-index, which controls how layers stack, they place the hidden “Confirm” button exactly under the decoy, so the victim's click passes through to the real control.

The attack relies on the victim already being logged in. Because the framed page runs on its real domain with the user's active session, the hidden click carries real authority, moving money, changing a setting, or granting a permission. This is why modern SameSite cookies, covered below, blunt many classic clickjacking attempts.

A single hijacked click is often just the opening move. Attackers chain clickjacking across multiple steps, such as adding items to a cart before confirming an order, or use it to deliver another web exploit like cross-site scripting.

Types of Clickjacking Attacks

Clickjacking has evolved into several variants, each hijacking a different action.

1. Classic clickjacking

Classic clickjacking hides a single sensitive button, such as a purchase or account-deletion control, under a decoy. An early case tricked users into changing their Adobe Flash webcam and microphone settings, silently enabling surveillance.

2. Likejacking

Likejacking targets social media actions. Around 2010, worms spread across Facebook by overlaying the “Like” button on decoy content, so victims unknowingly liked and reshared attacker pages, pushing the scam to their friends.

3. Cursorjacking

Cursorjacking deceives the user about where the cursor actually sits. By replacing the visible pointer with a fake one offset from the real position, the attacker makes a click land somewhere the user never intended.

4. Cookiejacking and filejacking

These variants trick users into dragging and dropping content. A disguised interface coaxes the victim into handing over browser cookies or selecting local files, which the attacker then reads.

5. Double clickjacking

Disclosed by researcher Paulos Yibelo in December 2024, double clickjacking exploits the timing between two clicks. A page asks the user to double-click a harmless prompt, then swaps in a sensitive control between the clicks, so the second click authorizes an action on the real site.

It bypasses every standard defense, including X-Frame-Options, CSP frame-ancestors, and SameSite cookies. Because those headers do not stop it, the fix is a client-side script that keeps sensitive buttons disabled until a real user gesture, an approach already used by Dropbox, Stripe, and GitHub.

Clickjacking vs CSRF

Clickjacking is often confused with cross-site request forgery (CSRF), but the two differ in one crucial way.

The distinction shapes the defense. A CSRF token cannot stop clickjacking, because the framed page loads legitimately on its own domain, and the request looks completely normal. Only controls that stop the page from being framed in the first place defend against it.

How to Prevent Clickjacking

Effective clickjacking defense is server-side: stop untrusted sites from framing the page at all.

Content-Security-Policy frame-ancestors

The Content-Security-Policy (CSP) frame-ancestors directive is the modern, recommended defense. It tells the browser which sites, if any, are allowed to embed the page in a frame. Set frame-ancestors 'none' to block all framing, or frame-ancestors 'self' to allow only the site's own domain.

X-Frame-Options

X-Frame-Options is the older header that CSP frame-ancestors now obsoletes. Set it to DENY or SAMEORIGIN to protect legacy browsers that predate CSP. Where both headers are present, modern browsers honor frame-ancestors and ignore X-Frame-Options.

SameSite cookies

The SameSite cookie attribute controls when session cookies travel with cross-site requests. Setting it to Lax or Strict keeps the victim's session cookie from reaching a framed page, so an authenticated clickjacking attack fails. Browsers apply SameSite=Lax by default now, which is why classic clickjacking has grown harder to pull off.

Why framebusting scripts fall short

Older sites used framebusting JavaScript to break out of frames, but it is unreliable. Attackers neutralize it with the iframe sandbox attribute, and it fails entirely when the browser blocks scripts. Two common mistakes still undo header defenses: placing these headers in a meta tag instead of an HTTP response header, which browsers ignore, and forgetting them on error pages or admin panels. For a full defense-in-depth checklist, the OWASP Clickjacking Defense Cheat Sheet is the authoritative reference.

Detect Clickjacking Exposure with CloudSEK BeVigil

Clickjacking protection is only as good as its coverage, and large organizations often miss the header on a forgotten subdomain, staging site, or admin panel. That single gap is what the phishing campaign above exploited.

CloudSEK BeVigil maps an organization's external web assets and flags the ones missing anti-framing headers, such as X-Frame-Options and CSP frame-ancestors, before an attacker frames them. It surfaces the exposed page rather than waiting for a breach report, closing the gap that manual header audits routinely leave open.

Frequently Asked Questions

Is clickjacking illegal?

Yes, clickjacking is illegal in most jurisdictions because it involves unauthorized actions and fraud. Using it to steal credentials or money violates computer misuse and fraud laws.

Can antivirus software stop clickjacking?

No, antivirus software cannot stop clickjacking, because the attack exploits a website's missing framing controls, not the user's device. Protection depends on the site setting anti-framing headers.

How do you test a website for clickjacking?

Load the site inside a test iframe: if it renders, the page lacks framing protection. Inspecting the response headers with browser DevTools, curl, or securityheaders.com confirms whether a framing control is present.

What is the difference between clickjacking and phishing?

Clickjacking hijacks a click on a real, framed website, while phishing lures the victim to a fake site to enter data. Attackers often combine the two, overlaying a phishing form on a framed legitimate page.

Does HTTPS prevent clickjacking?

No, HTTPS does not prevent clickjacking; it only encrypts data in transit. Stopping clickjacking requires framing controls like CSP frame-ancestors or X-Frame-Options.

Does clickjacking work on mobile devices?

Yes, clickjacking works on mobile through a variant called tapjacking that overlays invisible layers to hijack taps. Both mobile browsers and malicious apps can carry out the attack.