Missing Anti-Clickjacking Header? What It Means and How to Fix It
July 2026
ZAP, Nessus, Burp, and Qualys all flag it. Here is what the scanner warning means, when it matters, and the two headers that close the finding.
Blog
In-depth guides on clickjacking defense and web security.
DoubleClickjacking: The Attack That Bypasses X-Frame-Options, CSP, and SameSite
June 2026
Paulos Yibelo's attack uses window.opener.location to swap windows between clicks -- no iframe, so framing headers do nothing. How it works and how to defend against it.
X-Frame-Options vs CSP frame-ancestors: What Actually Protects Your Site
June 2026
ALLOW-FROM nullifies the entire header. default-src doesn't cover framing. Meta tags don't work for either mechanism. The sharp edges most guides skip.
Why JavaScript Frame-Busting Doesn't Stop Clickjacking
May 2026
Frame-busting scripts are easily bypassed via sandbox attributes, double framing, onBeforeUnload, 204 flushing, and designMode. HTTP headers are the only reliable defense.