What Is Clickjacking and How to Protect Yourself
What Is Clickjacking?
Clickjacking is a deceptive attack where you are tricked into clicking something different from what you perceive. Attackers overlay invisible or disguised elements on top of legitimate-looking content, so when you click what appears to be a harmless button, you actually click something hidden — authorizing an action, granting a permission, or triggering an unwanted operation.
The name comes from "click hijacking" — your click is hijacked to perform an action you did not intend. It is a subtle attack because everything appears normal while you are actually interacting with hidden malicious elements.
How Clickjacking Works
The typical clickjacking attack uses invisible layers:
1. The attacker creates a malicious page with appealing content (a game, a video, a tempting button). 2. They overlay an invisible iframe containing a legitimate site (your bank, a social media settings page) positioned precisely over the visible content. 3. When you click what you see (the game button), you actually click the invisible element beneath (the "transfer money" or "grant access" button). 4. Because you are logged into the legitimate site, the hidden action executes with your authority.
You see one thing; your click does another.
Common Clickjacking Targets
Social media actions: Tricking you into liking, sharing, or following without intent ("likejacking").
Permission grants: Getting you to grant camera, microphone, or location permissions.
Account settings changes: Modifying privacy settings or account configurations.
Financial actions: In severe cases, authorizing transactions or transfers.
OAuth authorizations: Tricking you into granting a malicious app access to your accounts.
Why Clickjacking Is Effective
Clickjacking exploits the gap between perception and reality:
- Everything looks legitimate and harmless
- The malicious elements are invisible or disguised
- You are often already logged into the targeted service, so actions execute with your authority
- It does not require you to enter credentials — it abuses your existing logged-in session
How to Protect Yourself
Keep your browser updated: Modern browsers include protections against clickjacking. Updates maintain these defenses.
Be cautious with embedded content: Be wary of sites that embed unexpected content, especially those urging you to click specific spots, complete "captchas" with unusual clicking, or play games requiring precise clicks.
Log out of sensitive accounts: Clickjacking often relies on you being logged into the targeted service. Logging out of sensitive accounts (banking, especially) when not in use reduces the risk.
Watch for permission prompts: If clicking something triggers an unexpected permission request (camera, location, app authorization), stop and reconsider.
Use script and frame blocking: Extensions like NoScript can block the framing techniques clickjacking relies on, though they require more technical management.
Be skeptical of "too good" content: Pages offering free prizes, shocking videos, or games that require specific clicking patterns are common clickjacking lures.
For Website Owners
If you operate a website, you can protect your users from clickjacking:
- Implement the X-Frame-Options header to prevent your site from being framed
- Use Content Security Policy (CSP) frame-ancestors directive
- These prevent attackers from embedding your site in their malicious overlays
Frequently Asked Questions
How do I know if I've been clickjacked?
Clickjacking is designed to be invisible, so it can be hard to detect in the moment. Signs include unexpected actions on your accounts (posts you did not make, settings that changed, permissions you did not knowingly grant). Reviewing your account activity periodically helps detect it.
Can clickjacking steal my password?
Clickjacking typically does not capture passwords directly — it abuses your existing logged-in session to perform actions. However, sophisticated attacks might combine clickjacking with other techniques. The main risk is unauthorized actions executed with your existing authority.
Does clickjacking work on mobile?
Yes, clickjacking (sometimes called "tapjacking" on mobile) works on mobile devices too, using overlay techniques. Mobile users should be equally cautious about apps and pages that overlay content or request unexpected permissions.
Conclusion
Clickjacking is a deceptive attack that hijacks your clicks to perform actions you never intended, exploiting the gap between what you see and what you actually interact with. Protecting yourself means keeping your browser updated, being skeptical of content that urges specific clicking, logging out of sensitive accounts when not in use, and watching for unexpected permission prompts. Awareness is the key defense — understanding that a click might not do what it appears to do keeps you alert to this subtle but potentially serious web threat.