probeo

How to block clickjacking?

clickjacking-no-frame-ancestors page

The issue

A page that any site can load in a frame can be placed, invisibly, over a decoy. A visitor who is signed in clicks what looks like a harmless button and instead confirms an action on your page: a purchase, a permission, a settings change. Their session is valid, so the action goes through.

The cause is a missing frame-ancestors directive. It is the part of a Content Security Policy that says which sites may embed the page, and without it the browser lets any site do so unless X-Frame-Options says otherwise.

Scope

Framing is decided per response. A site usually sets one policy everywhere, but a page that must be embeddable, such as a widget, can allow named origins while the rest refuse all framing.

How to check you have it

  • In probeo: a policy with no frame-ancestors is reported as csp:missing-frame-ancestors, graded minor. A response with no policy at all is reported as csp-missing.
  • By hand: run curl -sI https://your-site.example/ | grep -i content-security-policy and look for frame-ancestors. Then try loading the page in an <iframe> on another origin; a protected page refuses to render and the console names the directive.

The fix

Add frame-ancestors 'none' to the Content Security Policy, or list the origins that may embed the page.

Use 'self' only if the site frames its own pages. If partners embed a page on purpose, list their exact origins on that page alone. X-Frame-Options: DENY can stay alongside as a fallback for old browsers, as long as it says the same thing.

Done when: every response that shouldn’t be framed sends frame-ancestors with 'none' or a named list, and the check above comes back clean.

Do not

  • Do not use 'self' when no page on the site frames another.
  • Do not rely on JavaScript frame-busting as the defense.
  • Do not use a wildcard in frame-ancestors.

FAQ

Should frame-ancestors be set to ‘none’ or ‘self’?

Use 'none' unless the site frames its own pages. Sign-in and account pages should use 'none' in any case.

How does frame-ancestors differ from X-Frame-Options?

frame-ancestors can list several origins, and it is the one current browsers follow when both are present. X-Frame-Options only has DENY and SAMEORIGIN. Sending both is fine when they agree.

Can frame-ancestors break legitimate embedding?

Yes. Any partner that embeds the page has to be listed. Find out which pages are embedded, and by whom, before setting 'none' everywhere.

Does blocking iframes prevent all clickjacking?

It stops the framed form, which is the usual one. Tricks that use pop-up windows exist, but frame-ancestors is the control for the common case.

What happens when frame-ancestors conflicts with X-Frame-Options?

Browsers that support frame-ancestors use it and ignore X-Frame-Options. Keep the two consistent so the header you read is the one being enforced.

Should content pages and functional pages use different policies?

They can. A public article might allow embedding for syndication, while account pages refuse it. Make the difference deliberate, page type by page type.

Which product detects this

Probeo checks this on every page of your site as part of Site Clarity. This page explains one instance; the product tells you every page that has it.