thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Clickjacking

Tricking a user into clicking something different from what they perceive by overlaying a transparent framed page.

Definition

Also called UI redressing, the attacker frames the target site invisibly over a decoy so clicks perform actions like changing settings. Defenses are the CSP frame-ancestors directive, the X-Frame-Options header (DENY or SAMEORIGIN) and SameSite cookies.

Example

A victim clicks 'Play video' but actually clicks 'Delete account' in a hidden iframe.

Exam tip

Fix: frame-ancestors 'none' or X-Frame-Options: DENY.

Related terms