Clickjacking Poc

Understand and test clickjacking defences

Clickjacking tricks a user into clicking something different from what they perceive, by layering a hidden frame over a decoy. This tool explains clickjacking and helps you check whether a page is protected, so you can confirm your own pages defend against it.

How the attack and defence work

In a clickjacking attack, a malicious page loads your site invisibly in a frame and overlays a decoy, so a click meant for the decoy actually hits your site, potentially triggering an action the user did not intend. The defence is to stop your pages being framed by others, which is done with the X-Frame-Options header or a frame-ancestors directive in a Content-Security-Policy. Checking whether those protections are present tells you whether your pages can be weaponised this way. This is a defensive check on your own site.

Confirm your defences

The tool runs entirely in your browser, so nothing you paste is uploaded, which is exactly what you want when the input is your own security-sensitive data.

Related tools

• Password Strength Checker — Measure password strength by entropy and pattern analysis rather than character-class rules. Checked entirely in your browser.
• Password Generator — Generate strong random passwords and passphrases in your browser using the Web Crypto API. Nothing is transmitted, logged or stored.
• Hash Generator — Generate MD5, SHA-1, SHA-256 and SHA-512 hashes in your browser. Compare checksums and verify file integrity with nothing uploaded to a server.
• Base64 Encoder/Decoder — Encode and decode Base64 in your browser, including URL-safe Base64 and UTF-8 text. Handles files and data URIs locally with nothing uploaded.