Clickjacking

Clickjacking (also called a UI redress attack) embeds your site invisibly inside an <iframe> on a malicious page. The user thinks they are clicking a button on the malicious page, but they are actually interacting with your site underneath — potentially approving purchases, changing settings, or granting permissions.

Why it matters: Even a fully secure site can be exploited via clickjacking if it can be embedded in an iframe by a third party.

Quick tips:

• Add the X-Frame-Options: DENY (or SAMEORIGIN) response header to prevent your pages from being embedded in iframes.
• Use the frame-ancestors directive in CSP for more granular control — this supersedes X-Frame-Options in modern browsers.
• Test by trying to load your site in an <iframe> in the browser DevTools console.

See also: CSP, XSS, CSRF.