Blog

In-depth guides on clickjacking defense and web security.

• July 2026

  Missing Anti-Clickjacking Header? What It Means and How to Fix It

  ZAP, Nessus, Burp, and Qualys all flag it. Here is what the scanner warning means, when it matters, and the two headers that close the finding.

• June 2026

  DoubleClickjacking: The Attack That Bypasses X-Frame-Options, CSP, and SameSite

  Paulos Yibelo's attack swaps windows between the two clicks of a double-click. No iframe, so framing headers do nothing. How it works and how to defend against it.

• June 2026

  X-Frame-Options vs CSP frame-ancestors: What Actually Protects Your Site

  frame-ancestors overrides X-Frame-Options entirely, ALLOW-FROM is ignored, and default-src doesn't cover framing. The sharp edges most guides skip.

• May 2026

  Why JavaScript Frame-Busting Doesn't Stop Clickjacking

  A sandboxed iframe or a CSP sandbox still defeats frame-busting scripts, and Chrome blocks the bust-out without a user click. Which old bypasses are history, and what to send instead.