What is Clickjacking? A Guide for UK Business Website Owners

What is clickjacking? A guide for UK business website owners

Clickjacking — also called UI redressing — is an attack technique where a malicious website tricks your visitors into clicking on elements of your website without realising it. The attacker embeds your website invisibly inside their own page, positioned precisely so that your buttons and links sit directly under their visible content.

How clickjacking works

The attacker creates a page that appears to contain normal content — perhaps a game, a prize claim, or a survey. Your website is loaded in a transparent iframe positioned exactly over the interesting elements on the attacker's page. When the visitor clicks what they think is a button on the attacker's page, they are actually clicking a button on your website.

Because the visitor is potentially logged into your website, that click can trigger real actions: confirming a purchase, changing account settings, liking or sharing content, granting permissions, or submitting a form.

What clickjacking is used for

Clickjacking has been used to: trick users into enabling webcam or microphone access, force users to follow or share content on social media, initiate purchases or transfers on e-commerce and banking sites, change security settings on account management pages, and generate fraudulent advertising clicks.

Who is at risk

Any website that can be embedded in an iframe and that performs actions when users click buttons is potentially vulnerable. Social media platforms, e-commerce sites, banking applications, account management portals, and admin panels are the most common targets.

How clickjacking is prevented

The fix is straightforward. Two HTTP response headers prevent your website from being embedded in iframes on other websites.

The X-Frame-Options header with the value DENY or SAMEORIGIN tells browsers to refuse to display your page inside an iframe on any other domain.

The Content-Security-Policy header with a frame-ancestors directive achieves the same result with more granular control — for example, allowing embedding only on specific trusted domains while blocking all others.

Both headers are simple server-side configuration changes that your developer can implement in minutes.

Does Yrzo AI test for clickjacking?

Yes. Yrzo AI checks whether your website implements anti-framing headers as part of its 44 automated security checks. Starting at £399 for a full report.