Skip to content
ClickJack Test

Privacy Policy

Last updated October 12, 2026

The short version

  • There are no accounts, no ads, and no tracking cookies.
  • We don't store the addresses you test.
  • Your recent tests are kept in your own browser, not on our servers.
  • Visits are counted with Simple Analytics, which doesn't collect personal data.

When you test a site

The address you enter is sent to ClickJack Test's server, which requests that address (a HEAD request, retried as GET when needed) and reads the X-Frame-Options and Content-Security-Policy headers in the response. The response headers are sent back to you and the page content is discarded.

We don't save the address, the result, or your IP address, and our code doesn't log them. The site you test sees a request from ClickJack Test (user agent ClickJackTest/1.0), not from you. Local, private and internal network addresses are refused and never requested.

Your recent tests

The last 10 addresses you tested, with their results and when you tested them, are saved in your browser's local storage so you can run them again. They never leave your device. The “Clear all” button next to them deletes them, and so does clearing this site's data in your browser.

Shareable links

After a test, the address you tested is added to this page's own address (clickjacktest.com/?url=...) so you can share the result. Anyone who opens that link runs the same test again.

Analytics

We count visits with Simple Analytics, a privacy-first analytics service. It uses no cookies, doesn't collect personal data or IP addresses, and doesn't follow you across sites. It doesn't record the ?url= part of page addresses, so the sites you test aren't part of our analytics. See what Simple Analytics collects.

Hosting

ClickJack Test runs on Cloudflare. Like any host, Cloudflare handles each request, including your IP address, to deliver the site and protect it from abuse, and may set a cookie that's strictly needed for that protection. See Cloudflare's privacy policy.

The WP Anti-Clickjack WordPress plugin

The WP Anti-Clickjack plugin can check a WordPress site from outside with ClickJack Test. It does this only when a site administrator clicks “Check from outside”, and it sends only the site's homepage address. That address is handled exactly as described under “When you test a site”.

Changes

If this policy changes, the new version will be posted here with a new date at the top.