The Real Application Is Underneath
The target application is loaded in a frame. The attacker places other content above it so the victim does not realize where the click is actually landing.
Clickjacking is a browser-based attack that attempts to trick a user into clicking or interacting with a real application through a page they did not intend to use.
If you landed here because a penetration test identified missing anti-framing protections, this page explains what the finding means, when it matters, how to see the behavior for yourself, and where remediation usually starts.
The attack works by placing a legitimate page underneath deceptive or transparent content. The attacker cannot normally read the framed page, but they may still be able to position the victim's click over a real button or control.
The target application is loaded in a frame. The attacker places other content above it so the victim does not realize where the click is actually landing.
Clickjacking generally relies on a real user interaction. The attacker is trying to redirect that interaction toward a meaningful action in the framed application.
Anti-framing protections tell the browser which sites, if any, are allowed to embed the application. If the attacker cannot frame the page, the basic attack falls apart.
Enter a website address. If the page appears below in the proof-of-concept frame, then the application appears to permit framing by this site. That is useful evidence, but it does not by itself establish meaningful exploitability.
No scanning, exploitation, or requests beyond loading the URL in your browser.
The tester answers a narrow question: can this page be displayed inside a frame controlled by another site? Risk depends on what happens after that.
The target appears to allow this site to frame it. Anti-framing controls may be missing, incomplete, or intentionally permissive.
The site may be blocking framing with Content Security Policy (CSP), X-Frame-Options, or other application and browser behavior.
A tester should determine whether a realistic victim action can be influenced, whether authentication is required, and whether the action creates meaningful impact.
A frameable page is the prerequisite. The severity comes from the action an attacker can realistically place under the victim's click.
Static content, marketing pages, read-only information, or pages without meaningful user actions generally provide little value to a clickjacking attacker.
An authenticated application becomes more relevant when the victim's existing session exposes buttons or controls that change data, permissions, settings, or account state.
If a tester can reliably position a click over a sensitive action and show a realistic consequence, the issue should be evaluated based on that demonstrated impact rather than the missing header alone.
Remediation is usually straightforward, but the right policy depends on whether the application legitimately needs to be embedded by another site.
If the answer is no, block framing. Most standalone applications do not need to be embedded by unrelated sites.
Use an explicit Content Security Policy to allow only the origins that genuinely need to embed the application. Avoid broad or unnecessary framing permissions.
After the policy is deployed, verify that unauthorized sites can no longer frame the application and that legitimate integrations still work as intended.
Modern applications should generally control framing with the Content Security Policy (CSP) frame-ancestors directive. X-Frame-Options is an older control that is still commonly encountered and may be retained for compatibility.
For new implementations, frame-ancestors is the more flexible option because it can express an explicit list of trusted framing origins.
Block all framing
Allow only the same origin
Common legacy equivalent
Applications that must be embedded by trusted third parties should use an appropriately scoped frame-ancestors policy rather than disabling anti-framing protection entirely.
Clickjacking is commonly a Low-severity finding when the only demonstrated issue is that a page can be framed. Many bug bounty programs also exclude clickjacking without additional impact.
That does not make the control useless. It means the finding should be evaluated in context. A good penetration test distinguishes between a missing defensive header and a realistic attack that could cause something meaningful to happen.
Don't panic. A frameable page is only the beginning of the analysis. KobReySec performs hands-on penetration testing designed to validate exploitability, demonstrate real impact where it exists, and explain what the finding actually means in your environment.