--- title: Clickjacking Explained: how an invisible frame steals a click description: Any website can load yours inside an invisible frame and let someone click your buttons while they think they're clicking something else. One header stops it, and almost nothing can go wrong by adding it. canonical: https://watchfor.io/blog/clickjacking-explained --- # Clickjacking Explained: how an invisible frame steals a click 2026-09-08 · WatchFor Team · Security · security, web Any website can load yours inside an invisible frame and let someone click your buttons while they think they're clicking something else. One header stops it, and almost nothing can go wrong by adding it. Your site can be loaded inside another website. Not linked to — **loaded**, in a frame, on a page you've never seen, by someone you've never met. That's the default, and it has been since frames were invented. Usually nothing comes of it. Occasionally someone builds a page whose only purpose is to make you click a button in *your* app while you believe you're clicking something in *theirs*. That's clickjacking, and the fix is one line. ## How the trick works The attacker builds an ordinary-looking page — a prize wheel, a video player, a "click to continue" button. Then: 1. They load your site in an `