Clickjacking is one of the oldest tricks on the web, and it still works on any site that forgets one header. The attack is elegantly simple: your website gets loaded inside an invisible iframe on a page the attacker controls. The visitor sees a harmless button; the click actually lands on your site, on whatever element the attacker positioned underneath the cursor.

What that looks like in practice

The visitor thinks they are clicking "Play video". In reality they just clicked "Confirm payment", "Delete account" or "Approve" inside your interface, logged in with their own session cookie. Because the click is real and comes from the real user, your site processes it normally. Banking sites, admin panels and one-click purchase flows are the classic targets.

The fix is one line

X-Frame-Options: SAMEORIGIN

This tells the browser your pages may only be embedded by your own site. Use DENY if nothing should ever frame your pages, including your own site. There is no third useful value; the old ALLOW-FROM is dead.

The modern version: frame-ancestors

Content-Security-Policy has a directive that supersedes X-Frame-Options and is more flexible:

Content-Security-Policy: frame-ancestors 'self'

Modern browsers prefer frame-ancestors when both are present. The pragmatic approach in 2026 is to send both: frame-ancestors for current browsers, X-Frame-Options as the belt-and-braces fallback. Both OWASP and Mozilla recommend exactly this.

Will this break anything?

Only if something legitimately embeds your site: a partner portal, a preview tool, a page builder's live editor. Those cases are rare and visible; you will know within a day. For the overwhelming majority of business websites, nothing embeds you and SAMEORIGIN is free protection.

Not sure whether your site sends it? A free AuditMerlin scan checks both headers and links the finding to the OWASP guideline. Behind Cloudflare, adding them is a Transform Rule away, no server changes needed.