Clickjacking Protection Generator

Protect against clickjacking

Clickjacking is an attack where a malicious site loads your page inside an invisible frame and tricks a user into clicking something they did not intend, such as a hidden button. The defence is to control who may frame your page using HTTP headers. This generator produces both the older X-Frame-Options header and the modern Content-Security-Policy frame-ancestors directive, configured to deny all framing, allow only your own site, or permit a specific list of trusted origins.

The frame-ancestors directive is the current standard and can list multiple origins, which the single-valued X-Frame-Options header cannot.

Framing controls explained

Setting the policy to deny framing entirely is the safest choice for pages that never need to be embedded, such as login and banking pages. Allowing only the same origin lets your own site frame its pages while blocking others. If a trusted partner must embed your page, list their origin in frame-ancestors. Sending both headers maximises browser coverage, with X-Frame-Options as a fallback for older browsers.

Because X-Frame-Options cannot express a list of origins, use frame-ancestors when you need to allow specific external sites. Apply these headers to all sensitive pages. All generation happens locally in your browser.

Related tools

• Password Strength Checker — Measure password strength by entropy and pattern analysis rather than character-class rules. Checked entirely in your browser.
• Password Generator — Generate strong random passwords and passphrases in your browser using the Web Crypto API. Nothing is transmitted, logged or stored.
• Hash Generator — Generate MD5, SHA-1, SHA-256 and SHA-512 hashes in your browser. Compare checksums and verify file integrity with nothing uploaded to a server.
• Base64 Encoder/Decoder — Encode and decode Base64 in your browser, including URL-safe Base64 and UTF-8 text. Handles files and data URIs locally with nothing uploaded.