--- title: "What is Clickjacking in Website?" description: "What is Clickjacking in Website?" author: "Ravi Misra" published: 2022-12-13 updated: 2023-04-28 canonical: https://www.mindstick.com/forum/157257/what-is-clickjacking-in-website category: "web development" tags: ["web development", "java", "asp.net mvc"] reading_time: 3 minutes --- # What is Clickjacking in Website? What is [Clickjacking](https://www.mindstick.com/forum/157258/how-to-prevent-clickjacking-on-websites) in [Website](https://www.mindstick.com/articles/13110/why-copywriting-is-crucial-for-new-website-build)? how to prevent in [asp.net](https://www.mindstick.com/articles/934/default-folders-available-inside-the-asp-dot-net-application-folder) , [java](https://www.mindstick.com/articles/12214/web-development-company-in-india-laid-on-the-foundation-of-concrete-java-programming) and any other language. ## Replies ### Reply by Aryan Kumar Clickjacking is a type of web attack where an attacker tricks a user into clicking on a malicious link or button by hiding it behind a legitimate-looking one. This is done by overlaying a transparent layer on top of a legitimate website, which contains hidden buttons or links that perform actions the user did not intend. For example, a clickjacking attack might trick a user into clicking on a button that appears to be harmless, such as a "Like" or "Share" button on a social media site, but is actually a disguised link to a malicious website or a script that steals the user's personal information. Clickjacking attacks can be executed through various techniques such as using iFrames or CSS, and can target any website or application that allows user interaction through buttons, links or forms. To protect against clickjacking attacks, web developers can implement a number of defense mechanisms, including: 1. **X-Frame-Options header:** This header instructs the user's browser to deny display of a web page within a frame or iFrame, which can prevent clickjacking attacks. 2. **Content Security Policy (CSP):** This is a security feature that allows website owners to specify which content is allowed to be loaded on their web pages. CSP can be used to block malicious scripts and prevent clickjacking attacks. 3. **Frame-busting scripts:** These are scripts that prevent a web page from being loaded inside an iFrame or frame, which can help prevent clickjacking attacks. By implementing these defense mechanisms, web developers can help protect their users from clickjacking attacks and ensure the security of their websites and applications. \ ### Reply by Krishnapriya Rajeev Clickjacking is a type of cyber attack in which a website element is concealed as another element to trick the user into clicking on it. It can be used to *steal sensitive information* of the user or to *perform actions* on behalf of the user without them knowing. It can also be utilized to get more clicks on specific ads and *boost ad revenue*. An example of the same would be attackers using social engineering to lure victims into clicking on the hidden link, often with fake prizes or enticing images. ### Reply by Rizwan Khan When a not visible clickable element is placed over another clickable element, the user is tricked into clicking on the not visible element.\ Have you ever tried to watch a video from a dubious website and, as you press the play button, a pop-up appears or another tab opens in your browser? That is click hijacking in action. There are two common applications for this:\ 1.- Creating clicks for a marketing campaign.\ 2.- Cross-site request forgery (CSRF) attacks, which undertake operations in susceptible sites on behalf of the user. --- Original Source: https://www.mindstick.com/forum/157257/what-is-clickjacking-in-website Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.