--- title: Clickjacking Explained: how an invisible frame steals a click description: Any website can load yours inside an invisible frame and let someone click your buttons while they think they're clicking something else. One header stops it, and almost nothing can go wrong by adding it. canonical: https://watchfor.io/blog/clickjacking-explained --- [All posts](/blog) [Security](/blog/category/security) Sep 08, 2026 · 4 min read · WatchFor Team # Clickjacking Explained: how an invisible frame steals a click Any website can load yours inside an invisible frame and let someone click your buttons while they think they're clicking something else. One header stops it, and almost nothing can go wrong by adding it. Your site can be loaded inside another website. Not linked to — loaded , in a frame, on a page you've never seen, by someone you've never met. That's the default, and it has been since frames were invented. Usually nothing comes of it. Occasionally someone builds a page whose only purpose is to make you click a button in your app while you believe you're clicking something in theirs . That's clickjacking, and the fix is one line. ## How the trick works The attacker builds an ordinary-looking page — a prize wheel, a video player, a "click to continue" button. Then: - They load your site in an