Clickjacking Test.

Check X-Frame-Options and CSP frame-ancestors on a public URL, then apply header fixes.

Implementation Guide

Best Practices Overview

  • • Always implement both X-Frame-Options and CSP frame-ancestors
  • • Use SAMEORIGIN unless you specifically need to block all framing
  • • Test implementation across different browsers
  • • Consider adding JavaScript frame-busting code as an additional layer
  • • Regularly audit your security headers

Apache Server

Add to your .htaccess file or server configuration:

# X-Frame-Options
Header always append X-Frame-Options SAMEORIGIN

# Content Security Policy
Header always set Content-Security-Policy "frame-ancestors 'self';"

Note: Make sure mod_headers is enabled on your Apache server.

Additional JavaScript Protection

While not a replacement for proper header-based protection, you can add this JavaScript code as an extra security layer:

// Add to your main JavaScript file
if (window.top !== window.self) {
    window.top.location = window.self.location;
}

// Alternative method
if (window !== window.top) {
    window.top.location.href = window.location.href;
}

Testing Your Implementation

After implementing protection, verify it using:

  • 1. This clickjacking tester tool
  • 2. Browser developer tools (Network tab)
  • 3. Online security header checkers
  • 4. Create a test page that tries to frame your site

Need help hardening a production site?

For application security reviews and secure delivery practices, see Infyways security services.

Related tools

How it works

Four steps.

  1. 01

    Enter a public website URL to test for clickjacking protection.

  2. 02

    Run the check for X-Frame-Options and CSP frame-ancestors headers.

  3. 03

    Review the analysis and open the implementation guide for your stack.

  4. 04

    Apply the recommended headers, then re-test the URL.

Features

What this clickjacking test covers.

Header checks for X-Frame-Options and CSP frame-ancestors, plus stack-specific fix examples.

  • Header analysis

    Checks X-Frame-Options and Content-Security-Policy frame-ancestors on the response.

  • Frame policy readout

    Shows whether the site allows framing and how restrictive the policy is.

  • Risk summary

    Flags missing or weak clickjacking defenses so you know what to fix first.

  • Stack fix examples

    Copy header snippets for Apache, Nginx, Express, Next.js, Django, and ASP.NET.

  • frame-ancestors guidance

    Explains CSP frame-ancestors alongside classic X-Frame-Options values.

  • Re-test workflow

    After you deploy headers, run the same URL again to confirm protection.

FAQ

Questions.

Can't find an answer? Send us your question.

What does this clickjacking test check?

It inspects a public URL for framing defenses, especially X-Frame-Options and CSP frame-ancestors , then summarizes how protected the response looks.

Which headers should I set?

Prefer both layers: X-Frame-Options: SAMEORIGIN (or DENY) and Content-Security-Policy: frame-ancestors 'self' (or 'none'). The guide shows copy-paste snippets for common stacks.

Does JavaScript frame-busting replace headers?

No. Frame-busting scripts are an optional extra layer. Modern browsers rely on response headers; use the snippets in the Implementation Guide as the primary fix.

Can I test private or localhost sites?

The tester needs a publicly reachable URL so headers can be fetched. Local-only hosts are outside what this check can see.

What should I do after a weak result?

Add the headers for your server or framework from the guide, deploy, then run the same URL again to confirm X-Frame-Options and frame-ancestors are present.

Related tools

More Security & Privacy tools.

All 21 Security & Privacy tools →

Built by Infyways

Need more than a tool.

These utilities are made by the Infyways studio. When a free tool is not enough, we build the real thing.