# Clickjacking (Missing Frame Protection)

> Detects missing X-Frame-Options or Content-Security-Policy frame-ancestors directives.

- Skill: `zakirkun/clickjacking-missing-frame-protection` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/clickjacking-missing-frame-protection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/clickjacking-missing-frame-protection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/clickjacking-missing-frame-protection

---


# Clickjacking (Missing Frame Protection)

## Overview
Clickjacking embeds a target website in a transparent iframe on an attacker's page. The victim is tricked into clicking UI elements on the invisible iframe (e.g., approve a transfer, change settings, delete account).

## Detection Strategy
Look for HTTP responses that do not set either:
- `X-Frame-Options: DENY` or `X-Frame-Options: SAMEORIGIN`
- `Content-Security-Policy: frame-ancestors 'none'` or `'self'`

## Remediation
Use CSP `frame-ancestors` (modern, preferred) or `X-Frame-Options` (legacy).

```
X-Frame-Options: DENY
Content-Security-Policy: frame-ancestors 'none';
```