Clickjacking: click hijacking
Clickjacking is a discreet but formidable technique: it exploits the interface to make the victim interact with invisible or disguised elements. A single click can then trigger an unintended action.
What is clickjacking?
Clickjacking (“click hijacking”) tricks the user into clicking on an element they cannot see. The attacker overlays a trapped page on a legitimate site: the victim believes they are interacting with the displayed site while in reality triggering hidden actions: changing a password, deleting an account, validating an operation.
First seen in 2008, the technique was widely exploited in the 2010s. Many platforms have corrected the flaw, but some applications remain vulnerable. Often underestimated, in certain contexts it can have critical consequences, up to account theft.
How the attack works
A legitimate page in a frame
The attacker embeds the real site in an invisible frame (iframe), sometimes with fields pre-filled through URL parameters.
A lure on top
An attractive fake button is positioned with CSS exactly above the real button on the legitimate page.
An invisible overlay
By manipulating transparency and stacking order, the real frame becomes invisible: the victim clicks “through” the lure.
An action triggered without the user's knowledge
The click lands on the real button: e-mail change, sensitive validation… sometimes opening the way to account takeover.
Why it should not be neglected
Clickjacking is often dismissed because it relies on “elaborate” scenarios. Yet, combined with a sensitive feature (an e-mail address change, for example), it can turn a flaw considered minor into account takeover. The good news: it can be prevented with a few properly configured security headers, as part of an application security approach.
The defense principle: block unauthorized framing
Protecting against clickjacking means preventing your site from being displayed in a frame controlled by a third party. Two mechanisms make this possible: the X-Frame-Options header (legacy, still useful for older browsers) and, above all, the frame-ancestors directive of a Content Security Policy, which precisely defines who is allowed to frame your pages. Their effectiveness is verified through a penetration test.
Protect yourself, step by step
Configure X-Frame-Options
Block the display of your pages in a third-party frame, to cover browsers that still rely on this header.
Use CSP frame-ancestors
Explicitly define the origins allowed to frame your pages, the reference protection today.
Target sensitive pages
Prioritize high-impact functions: e-mail or password changes, payment validation.
Require confirmation
For critical actions, add an explicit confirmation step that is difficult to automate through a lure.
Strengthen cookies & sessions
Combine the SameSite attribute with cookies, consistently with protection against CSRF.
Why get support from BCIT?
A targeted assessment
We identify frameable sensitive pages and demonstrate the real impact of click hijacking.
Simple fixes
Properly configured and verified security headers, without unnecessary overhead for your teams.
Not ready to talk yet? Discover our cybersecurity assessment →
A click should never hold a surprise
Let's take 15 minutes to check that your sensitive pages cannot be framed and hijacked without your users' knowledge.
Clickjacking: click hijacking
Clickjacking is a discreet but formidable technique: it exploits the interface to make the victim interact with invisible or disguised elements. A single click can then trigger an unintended action.
What is clickjacking?
Clickjacking (“click hijacking”) tricks the user into clicking on an element they cannot see. The attacker overlays a trapped page on a legitimate site: the victim believes they are interacting with the displayed site while in reality triggering hidden actions: changing a password, deleting an account, validating an operation.
First seen in 2008, the technique was widely exploited in the 2010s. Many platforms have corrected the flaw, but some applications remain vulnerable. Often underestimated, in certain contexts it can have critical consequences, up to account theft.
How the attack works
A legitimate page in a frame
The attacker embeds the real site in an invisible frame (iframe), sometimes with fields pre-filled through URL parameters.
A lure on top
An attractive fake button is positioned with CSS exactly above the real button on the legitimate page.
An invisible overlay
By manipulating transparency and stacking order, the real frame becomes invisible: the victim clicks “through” the lure.
An action triggered without the user's knowledge
The click lands on the real button: e-mail change, sensitive validation… sometimes opening the way to account takeover.
Why it should not be neglected
Clickjacking is often dismissed because it relies on “elaborate” scenarios. Yet, combined with a sensitive feature (an e-mail address change, for example), it can turn a flaw considered minor into account takeover. The good news: it can be prevented with a few properly configured security headers, as part of an application security approach.
The defense principle: block unauthorized framing
Protecting against clickjacking means preventing your site from being displayed in a frame controlled by a third party. Two mechanisms make this possible: the X-Frame-Options header (legacy, still useful for older browsers) and, above all, the frame-ancestors directive of a Content Security Policy, which precisely defines who is allowed to frame your pages. Their effectiveness is verified through a penetration test.
Protect yourself, step by step
Configure X-Frame-Options
Block the display of your pages in a third-party frame, to cover browsers that still rely on this header.
Use CSP frame-ancestors
Explicitly define the origins allowed to frame your pages, the reference protection today.
Target sensitive pages
Prioritize high-impact functions: e-mail or password changes, payment validation.
Require confirmation
For critical actions, add an explicit confirmation step that is difficult to automate through a lure.
Strengthen cookies & sessions
Combine the SameSite attribute with cookies, consistently with protection against CSRF.
Why get support from BCIT?
A targeted assessment
We identify frameable sensitive pages and demonstrate the real impact of click hijacking.
Simple fixes
Properly configured and verified security headers, without unnecessary overhead for your teams.
Not ready to talk yet? Discover our cybersecurity assessment →
A click should never hold a surprise
Let's take 15 minutes to check that your sensitive pages cannot be framed and hijacked without your users' knowledge.