Glossary term
What is clickjacking? Meaning for developers
In The Browser Contract
An attacker shows your site invisibly inside their page, so users click your buttons by mistake. The frame-ancestors setting stops it.
Learn it properly · The Browser ContractLesson 7: Frontend Security Checklist: XSS, CSP, Clickjacking and Supply ChaindangerouslySetInnerHTML, CSP nonces, frame-ancestors, Subresource Integrity and risky packages. Each one asks: what would you check in a code review?In Security for Developers
A bad page loads your site in an invisible frame so the user's click lands on your real button. Stop it with frame-ancestors.
Learn it properly · Security for DevelopersLesson 2: XSS, CSRF, Clickjacking and Security HeadersHow a script gets into your page and how to stop it with output encoding and CSP, how CSRF uses your cookies, SameSite and CSRF tokens, frame-ancestors, and the headers worth setting.