CyberGuard dictionary / Web Application Security
Clickjacking
Clickjacking tricks a person into clicking a hidden or disguised interface element, often by placing a target page inside a frame.
In simple terms
A user thinks they are clicking one thing while their click activates a control on another page.
Technical explanation
An attacker can overlay a transparent framed page and align a sensitive control with a visible lure. Content-Security-Policy frame-ancestors and compatible X-Frame-Options rules limit who may frame a page; sensitive actions may need further confirmation.
Framing allows another page to place a real interface beneath a deceptive overlay. Browser framing restrictions reduce this path, while high-impact actions can add confirmation and reauthentication.
Examples in practice
A fake play button is positioned over a framed account settings button, causing an unwanted settings change.
A malicious site tries to frame the account page under a fake prize button. The site's frame policy blocks the embed, so the visitor never clicks the hidden account control.
Why it matters
The attack can turn a legitimate signed-in user's click into an unintended action.
VERIFY & LEARN MORE
Sources and further reading
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.