Glossary

Clickjacking

Clickjacking (UI Redress Attack) is an attack where an attacker overlays a transparent iframe of your site over their own page. The user thinks they are clicking a button on the malicious site, but is actually interacting with yours — confirming a transaction or changing settings.

Defence

X-Frame-Options — older header. DENY blocks all embedding; SAMEORIGIN allows only the same domain
Content-Security-Policy: frame-ancestors — modern replacement. More flexible: allows specific domains

// Nginx
add_header X-Frame-Options "DENY";
add_header Content-Security-Policy "frame-ancestors 'none'";

// PHP
header('X-Frame-Options: SAMEORIGIN');
header("Content-Security-Policy: frame-ancestors 'self' https://trusted.com");

Difference from CSRF

CSRF forges an HTTP request. Clickjacking tricks the user into clicking a legitimate element themselves — it does not forge a request but manipulates the click.