Clickjacking Protection Checker
Analyse your X-Frame-Options header and CSP frame-ancestors directive to check if your website is protected against clickjacking (UI redressing) attacks. Enter your header values, click check, and get an instant security score with detailed findings and actionable recommendations - all processed locally in your browser, no data uploaded.
Check if your website is protected against clickjacking attacks. Enter your X-Frame-Options header and CSP frame-ancestors directive to analyse your defences.
Valid values: DENY, SAMEORIGIN, or ALLOW-FROM uri
Format: frame-ancestors <sources>
Paste your X-Frame-Options header and CSP frame-ancestors directive above
All analysis happens locally in your browser - no data leaves your device
Why Use Our Clickjacking Protection Checker?
Instant Clickjacking Analysis
Paste your X-Frame-Options header and CSP frame-ancestors directive to get an immediate security assessment. The checker parses both headers, validates their values, and determines your overall protection level against clickjacking attacks with a security score.
Vulnerability Detection & Warnings
Automatically detects missing headers, invalid values, deprecated directives, and wildcard sources that leave your site vulnerable. Each vulnerability is clearly explained with severity indicators and actionable remediation steps.
Dual-Header Coverage Analysis
Evaluates both X-Frame-Options (for legacy browser support) and CSP frame-ancestors (for modern browsers). The combined analysis ensures your protection works across all browsers, from older versions to the latest releases.
Actionable Security Recommendations
Get specific, prioritised recommendations for improving your clickjacking defences. Each recommendation explains exactly what to change, why it matters, and how it affects your overall security posture - all based on current best practices.
Common Use Cases for Clickjacking Protection Checker
Web Security Audit & Compliance
Audit your clickjacking defences before deploying to production. Verify that your X-Frame-Options and CSP frame-ancestors headers are correctly configured to protect against UI redressing attacks. Essential for security compliance standards like PCI DSS, OWASP Top 10, and ISO 27001.
DevOps & Deployment Verification
Integrate clickjacking protection checking into your CI/CD pipeline. Before deploying header configuration changes to production, validate them through the tool to ensure your security headers remain correctly configured after infrastructure updates or migrations.
Third-Party Embedding Configuration
When your site needs to be embeddable by trusted third parties (payment gateways, partner dashboards, analytics tools), use the checker to configure frame-ancestors with specific allowed origins while maintaining protection against untrusted domains.
Legacy Browser Compatibility Check
Ensure your clickjacking protection works across all browsers. X-Frame-Options is supported by older browsers, while CSP frame-ancestors provides modern protection. The checker helps you configure both headers for maximum compatibility without sacrificing security.
Security Incident Investigation
When investigating a suspected clickjacking attack or UI redressing incident, use the checker to verify whether your headers were correctly configured at the time of the incident. Identify misconfigurations that may have been exploited.
Learning Web Security Headers
Learn how clickjacking protection works by experimenting with different header configurations. See how DENY differs from SAMEORIGIN, understand CSP frame-ancestors syntax, and learn best practices for securing web applications against framing attacks.
Understanding Clickjacking Protection
What is Clickjacking?
Clickjacking (also known as a UI redressing attack) is a malicious technique where an attacker tricks a user into clicking on something different from what the user perceives. The attacker embeds the target website in a transparent iframe overlaid on a decoy page. When the user clicks on what appears to be a harmless button or link, they are actually interacting with the hidden target page. This can lead to unintended actions such as liking a post, making a purchase, changing account settings, or submitting sensitive information - all without the user's knowledge or consent.
How Our Clickjacking Protection Checker Works
- Parse Headers: The checker takes your X-Frame-Options header value (DENY, SAMEORIGIN, or ALLOW-FROM) and your CSP frame-ancestors directive, parsing each according to its respective specification (RFC 7034 for X-Frame-Options, CSP Level 2 for frame-ancestors).
- Analyze Protection: Each header is evaluated individually for validity and protection level. X-Frame-Options: DENY and frame-ancestors 'none' are considered fully protected. SAMEORIGIN, ALLOW-FROM, and specific origin lists are assessed as partial protection based on their scope.
- Generate Report: A combined analysis produces an overall security score (0-100), vulnerability list, and prioritised recommendations. The report considers both headers together to provide a complete picture of your clickjacking defences.
X-Frame-Options vs CSP frame-ancestors
- X-Frame-Options: A simple HTTP header supported since IE8 and all major browsers. Accepts only three values: DENY (block all framing), SAMEORIGIN (allow same-origin framing), and ALLOW-FROM (allow specific origin - deprecated). Limited to a single origin and does not support wildcards or multiple domains.
- CSP frame-ancestors: A more flexible Content Security Policy directive supported in modern browsers (Chrome 40+, Firefox 33+, Safari 10+). Supports multiple origins, wildcards, 'self', and 'none'. Can specify multiple trusted domains and is the recommended approach for modern web applications.
- Best Practice: Use both headers together. CSP frame-ancestors provides modern, flexible protection while X-Frame-Options covers legacy browsers that do not support CSP. When both are set, the browser applies the most restrictive policy.
Privacy & Security
Your header values never leave your device. All parsing, validation, and analysis happens entirely in your browser using client-side JavaScript. No data is uploaded to any server, no cookies or tracking are involved, and no API keys or signup are required. You can safely analyse even the most sensitive security configurations for internal applications without any privacy concerns. The tool is completely free to use with no limitations on how many configurations you can check.
Related Tools
DNS Propagation Checker
Check if DNS changes have propagated by querying multiple global nameservers (Cloudflare, Google, Quad9). Shows propagation status across regions with live results and colour-coded status indicators - free online DNS propagation checker.
Domain Age Checker
Check the age of any domain in years, months, weeks, and days. Enter a domain name to get its creation date, registration timeline, registrar info, and SEO authority estimate based on domain age - all fetched from the official RDAP registry in real time. Free online domain age checker.
Bulk WHOIS Lookup
Check domain registration information for up to 20 domains at once using the RDAP protocol. View registrar, creation date, expiry date, nameservers, and domain status codes in a sortable table - free online bulk WHOIS lookup.
Domain Expiry Checker
Check when any domain expires - enter a domain name to see its expiration date, days remaining, registrar lock status, auto-renew status, and complete WHOIS details. Colour-coded health indicators show whether renewal is urgent. Free online domain expiry checker.
Frequently Asked Questions About Clickjacking Protection Checker
Clickjacking (or UI redressing) is an attack where a malicious page embeds a legitimate website in a transparent iframe and tricks users into clicking on it. The user thinks they are clicking on the visible page, but they are actually interacting with the hidden iframe. This can lead to unintended actions like changing account settings, making purchases, posting content, or granting permissions - all without the user's knowledge. Clickjacking is particularly dangerous because the user sees no visible evidence of the attack.
X-Frame-Options is a simpler, older header (RFC 7034) that only accepts three values: DENY (block all), SAMEORIGIN (allow same origin), and ALLOW-FROM (specific origin, deprecated). CSP frame-ancestors is a more modern, flexible directive that supports multiple origins, wildcards, and the 'none' and 'self' keywords. Modern browsers support both, but CSP frame-ancestors is recommended as it provides more granular control. For maximum compatibility, you should set both headers - legacy browsers only support X-Frame-Options.
X-Frame-Options is supported by all major browsers including Internet Explorer 8+, Chrome 4+, Firefox 3.6+, Safari 4+, Opera 10.5+, iOS Safari 4.2+, and Android Browser 4.0+. It is widely considered the most compatible clickjacking protection mechanism, making it essential for legacy browser support. CSP frame-ancestors is supported in Chrome 40+, Firefox 33+, Safari 10+, and Edge 15+.
No. X-Frame-Options: ALLOW-FROM is deprecated and not supported by Chrome or Safari. It was never widely adopted and has been removed from the specification. If you need to allow framing from specific origins, use CSP frame-ancestors instead, which supports multiple origins and is the modern, recommended approach.
When both headers are present, the browser applies the most restrictive policy. Modern browsers will use the CSP frame-ancestors directive (since CSP takes precedence over X-Frame-Options), while older browsers that do not support CSP will use X-Frame-Options. This dual-header approach provides the best coverage across all browsers.
Yes. To allow specific websites to embed your page, set CSP frame-ancestors with the trusted origins: "frame-ancestors 'self' https://trusted-site.com https://partner-site.com". Also set X-Frame-Options: SAMEORIGIN as a fallback for legacy browsers (note this allows same-origin framing only - supported browsers will respect the more permissive CSP). For full cross-origin embedding without CSP support, you may need to omit X-Frame-Options, but be aware this reduces protection for legacy browsers.
Use our Clickjacking Protection Checker to test your X-Frame-Options and CSP frame-ancestors configuration. Additionally, you can create a simple HTML page with an iframe pointing to your site. If the iframe loads successfully, your site may be vulnerable. You can also use browser developer tools to inspect the response headers and verify they include the correct protection headers.
Yes, the Clickjacking Protection Checker is completely free to use. All parsing and analysis happens entirely in your browser - no data is uploaded to any server, no API keys are required, and no signup is needed. You can check as many header configurations as you want, including sensitive internal security policies, with complete privacy guaranteed.