---
title: "How to prevent Clickjacking on websites?"  
description: "How to prevent Clickjacking on websites?"  
author: "Ravi Misra"  
published: 2022-12-13  
updated: 2023-11-27  
canonical: https://www.mindstick.com/forum/157258/how-to-prevent-clickjacking-on-websites  
category: "web development"  
tags: ["web development", "java", "asp.net mvc"]  
reading_time: 2 minutes  

---

# How to prevent Clickjacking on websites?

**How to prevent [Clickjacking](https://www.mindstick.com/forum/157257/what-is-clickjacking-in-website) on websites?**

I want to prevent Clickjacking in [asp.net](https://www.mindstick.com/articles/934/default-folders-available-inside-the-asp-dot-net-application-folder) using the [web.config](https://www.mindstick.com/forum/183/web-config-file) file.

## Replies

### Reply by Aryan Kumar

Clickjacking is a technique where an attacker tricks a user into clicking on something different from what the user perceives, potentially leading to unintended actions. To prevent clickjacking on websites, you can implement various security measures. Here are some recommended practices:

## X-Frame-Options Header:

- Use the **X-Frame-Options** HTTP header to control whether your site can be embedded within an .
- Set the header to **DENY** to prevent any framing or use **SAMEORIGIN** to allow framing only from the same origin.

## Content Security Policy (CSP):

- Implement a Content Security Policy to define and control the trusted sources of content on your website.
- Specify the **frame-ancestors** directive to restrict which domains can embed your content.

## JavaScript Frame-Busting Code:

- Include frame-busting JavaScript code within your web pages to break out of frames and ensure that your content is only displayed in the top-level window.

## Clickjacking Protection in Browsers:

- Some modern browsers provide built-in protection against clickjacking. Keep your users' browsers updated to benefit from the latest security features.

## Use the sandbox Attribute:

- When appropriate, use the **sandbox** attribute on iframes to restrict their behavior, limiting their capabilities and preventing potential security risks.

## Educate Users:

- Educate users on recognizing phishing attempts and suspicious behavior. Make them aware of the importance of not clicking on unfamiliar or unexpected links.

## Implement Two-Factor Authentication (2FA):

- Adding an additional layer of security, such as two-factor authentication, can mitigate the impact of potential unauthorized actions even if clickjacking occurs.

By implementing a combination of these techniques, you can significantly reduce the risk of clickjacking on your website and enhance the overall security of user interactions. Keep in mind that security measures should be regularly reviewed and updated to adapt to evolving threats and vulnerabilities.


---

Original Source: https://www.mindstick.com/forum/157258/how-to-prevent-clickjacking-on-websites

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.