How do you prevent clickjacking?

Clickjacking loads your site in a transparent iframe on the attacker's page, positions a decoy underneath, and lets the victim click what they think is a harmless button — while the click actually lands on yours. Because the user really is logged in, the action goes through with their session.

The fix is one header

Tell the browser who may frame you:

Content-Security-Policy: frame-ancestors 'none'

'none' blocks all framing. 'self' allows your own origin, and you can list specific origins instead:

Content-Security-Policy: frame-ancestors 'self' https://partner.example.com

frame-ancestors is the modern directive and it supersedes the older header:

X-Frame-Options: DENY

X-Frame-Options only understands DENY and SAMEORIGIN — it cannot express an allowlist, and ALLOW-FROM was never widely supported. Send both if you still care about very old browsers; frame-ancestors wins where both are present.

Two details that catch people

It must be a response header. A <meta> tag does not work for frame-ancestors, because the browser has to know before it renders anything.

And it must be on every response, not just the login page. Any authenticated page that performs an action is a target.

Supporting measures

• SameSite=Lax or Strict on session cookies means the framed page may not even be authenticated.
• Require a deliberate confirmation step for destructive actions, so a single stolen click is not enough.
• Legacy "framebusting" JavaScript that checks window.top !== window.self is easy to defeat with the sandbox attribute — treat it as a fallback at best, never the main defence.