[Blog](/blog)

Show links

Resources

[Blog](/blog)

[Breaches](/breaches)

[eBooks, reports, & more](/resources)

[Events](/events)

[News](/news)

[Cybersecurity](/category/cybersecurity)

Show links

Categories

[Attack Surface Management](/category/attack-surface-management)

[Company News](/category/company-news)

[Compliance and Regulations](/category/compliance-and-regulations)

[Cybersecurity](/category/cybersecurity)

[Data Breaches](/category/data-breaches)

[DevOps](/category/devops)

[Human Cyber Risk](/category/human-cyber-risk)

[Risks and Vulnerabilities](/category/risks-and-vulnerabilities)

[Third-Party Risk Management](/category/third-party-risk-management)

[Vendor Risk Management](/category/vendor-risk-management)

[What is Clickjacking? The Best Attack Prevention Methods](/blog/what-is-clickjacking)

Publish date

January 8, 2025

{x} minute read

# What is Clickjacking? The Best Attack Prevention Methods

[Get a demo](/contact-sales)

[Free trial](/demo)

[Download the PDF guide](/resources/complete-guide-to-data-breaches)

[Free trial](/demo)

Written by

[Edward Kost](/team/edward-kost)

Senior Cybersecurity Writer

Edward is a cyber writer with a mechanical engineering background. His work has been referenced by academic institutions and government bodies.

Reviewed by

[Kaushik Sen](/team/kaushik-sen)

Chief Marketing Officer

Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education.

Table of contents

eBook

A Complete Guide to Data Breaches

Free resource

### A Complete Guide to Data Breaches

Learn how to avoid a costly data breach with a comprehensive prevention strategy.

[Download now](/resources/complete-guide-to-data-breaches)

Cyber attackers are continuously cultivating their methods to evade detection. Now, they can cloak a seemingly innocuous webpage with an invisible layer containing malicious links. This method of attack, known as clickjacking, could cause you to activate your webcam or transfer money from your bank account.

In this post, we outline the different types of clickjacking attacks and teach you how to best defend yourself against this application security threat.

## What is Clickjacking?

Clickjacking (or click hijacking) is a type of [cyber attack](https://www.upguard.com/blog/cyber-attack) where an unseen malicious link is placed over a website's user interface. Because clickjacking occurs on an invisible iframe layer loaded on top of a legitimate page, visitors usually cannot identify when a clickjacking attack is taking place.

‍

‍

There are two victims in a clickjacking attack - the host website and the visitor. The host website is used as a platform to facilitate the clickjacking attack, and the visitor becomes a victim to the specific intention of the attack.

Some common types of clickjacking attacks include:

* Login credential theft
* Webcam or microphone activation
* Invitation of malware downloads
* Authorization of money transfers
* Unsolicited product purchases
* Identifying your location

Clickjacking intentions are not limited to this list. Because user interfaces can be cloaked with any type of link (UI redressing), the destructive options are limitless.

## Clickjacking Examples

Here are some examples of the most notorious types of clickjacking attacks.

### Money transfer scams

In this UI redress attack, an attacker tricks you into clicking a link on a malicious page that authorizes the transfer of money from your bank account.

Here's an overview of the process:

First, the victim is presented with a seemingly innocuous website that could be loaded from a link in an email. Such websites usually promote an irresistible offer, like a free gift or a holiday deal.

When the website loads and the victim clicks the button to claim their 'free gift', they're actually clicking on a funds transfer confirmation link on an invisible web application layer. If the victim is logged into their bank at the time, their money will instantly be transferred to the attacker's account.

While the unsolicited transfer is taking place in the background, the victim is redirected to a page with more information about their 'free gift.'

### Webcam and microphone activation

In this clickjacking attack, a user's adobe flash settings are invisibly loaded over another link. When the infected link is clicked, users modify their adobe flash plug-in settings to give attackers access to their webcam and microphone.

### Likejacking

In a likejacking attack, users are tricked into clicking a Facebook page "like" button when they click on a presented link. A user needs to be logged into Facebook when the link is clicked for the attack to be successful.

Social media accounts are also vulnerable to clickjacking. Twitter fell victim to a successful attack in 2009 known as a tweet bomb.

The tweet bomb was a continuous cycle of users clicking on a tweeted link, then clicking a clickjacked link in the opened web page, which then tweeted that original link on their account, promoting their followers to click the link, etc.

‍

‍

### Cursorjacking

cursorjacking is a form of clickjacking where a duplicate cursor is created and attached to the real cursor at a specified offset. Only the duplicate cursor is visible. If there's a specific area of the screen the attacker knows the user will click on, they can strategically offset the real hidden cursor so that when the fake cursor is maneuvered to this area, a malicious link is clicked.

Cursorjacking was possible due to [vulnerabilities](https://www.upguard.com/blog/vulnerability) in Firefox. These security flaws have been [amended in Firefox 30](https://www.mozilla.org/en-US/security/advisories/mfsa2014-50/).

### Malware downloads

An attacker could initiate the download of [malware](https://www.upguard.com/blog/malware) when a user clicks on a hijacked link. Malware can corrupt the software of a system or establish a gateway for [advanced persistent threats](https://www.upguard.com/blog/cyber-threat).

## Preventing Clickjacking attacks

If you wanted to measure the vulnerability of your website before implementing clickjacking defenses. refer to this [OWASP clickjacking cheat sheet](https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html#Defending_with_X-Frame-Options_Response_Headers).

Clickjacking mitigation can be achieved on both the client-side and the server-side. Let's discuss the options for both scenarios.

### Server-side clickjacking prevention

Many clickjacking attacks occur on duplicates of legitimate websites. An attacker could clone your website and weaponize it with hijacked links hidden on top of it. Besides the devastating consequences for users, your business could suffer irremediable reputation damage.

You need to, therefore, ensure that none of your web pages can be wrapped in a \<FRAME> or \<IFRAME> tag.

There are tw&#x6F;**&#x20;**&#x77;ays you can do this:

#### 1. Specify the correct Content-Security-Policy frame-ancestors directive.

The [Content Security Policy](https://content-security-policy.com/) (CSP) with its frame-ancestors directive, is a highly effective [cybersecurity](https://www.upguard.com/blog/cyber-security) tactic against webpage embedding.

Besides protecting your website from iframe embedding, the Content-Security-Policy also protects your website from [cross-site scripting](https://www.upguard.com/blog/top-10-ways-to-harden-nginx-for-windows) (XSS), one of the [most common types of cyber attacks](https://owasp.org/www-project-top-ten/).

To implement this defense you need to first ensure your web server is set to return the Content-Security-Policy. Once CSP has been [added to your website](https://dev.to/mattferderer/what-is-csp-why--how-to-add-it-to-your-website-28df), the appropriate CSP frame-ancestors directive response headers can be set to disallow embedding.

The frame-ancestors 'none' directive will prevent all domains from embedding your website in a frame.

For example:

‍

*Header set Content-Security-Policy "frame-ancestors none;"*

‍

If you wanted to enable embedding by your domain only, you would enable the frame-ancestors 'self' directive as follows:

‍

*Header set Content-Security-Policy "frame-ancestors 'self';"*

‍

To permit a domain outside of your own to embed your web pages, you need to [use the 'data:' scheme](https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/Data_URIs) and specify the whitelisted URI. This, however, is not a secure method and can be bypassed by injecting multiple arbitrary data: URIs.

#### 2. Specify the x-frame-options deny directive

The [x-frame-options response header](https://www.upguard.com/blog/10-tips-for-securing-your-nginx-deployment) specifies whether a browser is permitted to embed your web pages in a frame.

The x-frame-options response header will eventually become obsolete and replaced by the frame-ancestor directive so it should not be your primary method of defense.

To send the correct x-frame-options HTTP headers from your website resources, you need to set the directive to 'deny.'

For example:

‍*‍*

*X-Frame-Options*: DENY

‍

Once your x-frame-options is set to the deny directive on the server-side, all attempts to load your website in a frame will be blocked. This is equivalent to the frame-ancestors none defective of the Content Security Policy.

If you wanted to permit framing by your own domain only, you would set the same origin directive as follows:

‍

*X-Frame-Options*: SAMEORIGIN

‍

This is equivalent to the frame-ancestors self-directive of the Content Security Policy. it will only permit framing of your web content if the parent shares the same origin.

### Client-side clickjacking prevention

Client-side clickjacking prevention isn't as effective as server-side prevention tactics. These methods should be implemented as a secondary option.

#### 1. Frame busting scripts

Frame busting scripts prevent your website from functioning inside a frame. Via Javascript add-ons, you can specify how a browser should react when your page is loaded in a frame.

A common frame buster technique is to force the browser to reload the offset decoy web page at the top window. By doing so, the decoy website is loaded on top of the malicious iframe layer.

This action can be prompted with the following lines of Javascript:

‍

\<script>

     if (top != window) {

       top.location = window\.location;

     }\
   \</script>

This defence can, however, be easily circumvented. The attacker could block the forced reload attempt with the following lines of Javascript:

‍

  \<script>

     window\.onbeforeunload = function() {

       return false;

     };

   \</script>

Another way frame busting scripts can be circumvented is by using the HTML 5 iframe sandbox attribute.

Here's an example of the Javascript code:

‍

  \<iframe id="decoy\_webpage"

         src="https\://decoy-website.com"

         sandbox="allow-scripts allow-forms allow-same-origin">

   \</iframe>

By omitting the allow-top-navigation attribute, the iframe containing the decoy web page cannot be loaded on top of the invisible page. With this defense in place, the attacker is able to permit the browser to run scripts and submit forms.

Frame busting scripts are not a recommended defense against clickjacking attacks. Many web browsers block frame busting Javascript code and the browsers that don't [can be easily tricked](https://seclab.stanford.edu/websec/framebusting/) to permit the malicious overlay.

A [study by the Standford Web Security Group](https://crypto.stanford.edu/~dabo/pubs/papers/framebust.pdf) outlines the clickjacking vulnerabilities of frame busting methods.

#### 2. Install browser extensions

Anti-clickjacking browser extensions don't provide the best user experience because they disable all the javascript on loaded websites. Many popular websites like Facebook, Twitter and Youtube run on Javascript and these extensions will impede their functionality.

To maintain the Javascript experience on trusted sites, you would need to manually specify a whitelist

Here's a list of Javascript blocking add-ons for different browsers

##### Chrome

[Scriptsafe](https://chrome.google.com/webstore/detail/scriptsafe/oiigbmnaadbkfbmpbfijlflahbdbdgdf?hl=en) is an extension for Chrome.

##### Mozilla Firefox

[NoScript](https://addons.mozilla.org/en-US/firefox/addon/noscript/) is a Mozilla Firefox browser add-on.

##### Safari

[JS Blocker](https://jsblocker.toggleable.com/) is a Safari browser extension.

##### Microsoft Edge

[Javascript Toggle ON and Off](https://microsoftedge.microsoft.com/addons/detail/javascript-toggle-on-and-/ihjhpikpfleehggnjhhlogahjdnpkpdb?hl=en-US) is an add-on you can install on Microsoft Edge.

##### DuckDuckGo

Duckduckgo doesn't have a Javascript blocking add-on you can install, but they do offer an alternative browser specifically developed to block Javascript websites. You can [access this browser here](https://html.duckduckgo.com/html).

##### Internet explorer

To disable Javascript on internet explorer, follow this process:

1. Select the gear icon in the top right corner or press ALT+X
2. From the drop-down menu select 'Internet options'
3. Click the 'Security' tab
4. Click 'custom level'
5. Under 'Active Scripting' select 'Disable-ON'
6. Select 'Yes' to confirm

eBook

A Complete Guide to Data Breaches

Free resource

### A Complete Guide to Data Breaches

Learn how to avoid a costly data breach with a comprehensive prevention strategy.

[Download now](/resources/complete-guide-to-data-breaches)

## Related posts

Learn more about the latest issues in cybersecurity.

Cybersecurity

#### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026)

A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news.

[](/team/revashni-moodley)

[Revashni Moodley](#)

October 14, 2026

Cybersecurity

#### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization)

Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us.

[](/team/revashni-moodley)

[Revashni Moodley](#)

August 25, 2026

Cybersecurity

#### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack)

Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook.

[](/team/nicholas-sollitto)

[Nicholas Sollitto](#)

June 1, 2026

Cybersecurity

#### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025)

Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here.

[](/team/revashni-moodley)

[Revashni Moodley](#)

October 14, 2026

Cybersecurity

#### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command)

Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more.

[](/team/revashni-moodley)

[Revashni Moodley](#)

December 1, 2025

Cybersecurity

#### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos)

Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap.

[](/team/phil-ross)

[Phil Ross](#)

September 3, 2026

[All posts](/blog)

Experience superior visibility and a simpler approach to cyber risk management

[Get a demo](/contact-sales)

[Free trial](/demo)