Clickjacking Test — X-Frame-Options & Frame Embedding
Detect iframe embedding risk from X-Frame-Options and Content-Security-Policy frame-ancestors
How to Use This Tool
- Enter the full HTTPS URL of the page you want to protect — typically your login or account settings route.
- We fetch response headers from the URL using a safe server-side request.
- X-Frame-Options value is read if present (DENY, SAMEORIGIN, or ALLOW-FROM variants).
- Content-Security-Policy is scanned for the frame-ancestors directive and its value is extracted.
- Framing is allowed when X-Frame-Options is missing or ALLOWALL and frame-ancestors is absent or *.
- Results show Protected or Potentially Vulnerable with the raw header values for your records.
About This Tool
Clickjacking tricks users into clicking hidden elements by overlaying your site inside a transparent iframe on an attacker-controlled page. Defenses rely on X-Frame-Options and Content-Security-Policy frame-ancestors directives that forbid or restrict framing. VSPIC fetches your URL, extracts framing-related headers, and reports whether the page appears protected or potentially vulnerable to embedding.
A page is flagged potentially vulnerable when X-Frame-Options is absent or set to ALLOWALL, and when CSP frame-ancestors is missing or set to wildcard *. Protected pages show DENY, SAMEORIGIN, or a restrictive frame-ancestors list. Use this after header configuration changes and alongside the security headers checker for full coverage.
Common use cases
- •Check if a VPN or proxy is detected on your connection
- •Validate SSL certificates before launch
- •Scan for email addresses in known breaches
What clickjacking attacks look like
An attacker loads your banking or admin login in an invisible iframe, then places fake buttons aligned with real submit controls. The victim believes they click 'Win a prize' but authorizes a transfer or changes account settings. Because the click is genuine, traditional CSRF tokens on the framed page may still submit.
Any page that performs sensitive actions without framing protection is a candidate target — not only login forms but 'confirm purchase' and 'delete account' flows.
X-Frame-Options behavior
DENY prevents all framing. SAMEORIGIN allows framing only by pages on the same scheme-host-port. ALLOWALL explicitly permits any embedder and should never be used on sensitive routes. Legacy ALLOW-FROM is largely unsupported in modern browsers.
Our test treats missing X-Frame-Options as permissive unless CSP frame-ancestors compensates.
CSP frame-ancestors as modern defense
frame-ancestors replaces X-Frame-Options in CSP Level 3. Values like frame-ancestors 'none' or frame-ancestors 'self' block untrusted embedders. frame-ancestors * allows any parent — equivalent to no protection.
When both headers exist, CSP frame-ancestors takes precedence in supporting browsers. Configure at least one restrictive directive.
Why login pages need framing blocks
Authentication endpoints are high-value clickjacking targets. Even if credentials are submitted over TLS, framing enables UI redress attacks that bypass user intent. Apply DENY or frame-ancestors 'none' on login, password reset, and payment confirmation URLs.
Marketing landing pages may intentionally allow embedding — segment policy by route rather than applying one global header.
Testing vs actual iframe proof
Header analysis predicts browser behavior without rendering an iframe on our infrastructure. This is faster and safer for bulk audits. For visual confirmation, attempt to embed your page in a local HTML iframe test file after deploying headers.
Some legacy browsers ignore CSP — retaining X-Frame-Options DENY as backup remains best practice during transition periods.
Common false senses of security
JavaScript frame-busting scripts are unreliable — attackers can disable them. Rely on headers enforced by the browser engine. Partial site coverage where only homepage has DENY but /login does not leaves the vulnerable route exposed.
Third-party widgets that require iframe embedding should live on separate subdomains with relaxed policy, not on authenticated app routes.
Relationship to security headers score
X-Frame-Options presence contributes twenty points on the headers checker. This dedicated test interprets values and CSP interaction specifically for clickjacking risk rather than binary presence.
Run both tools on critical URLs — presence of a weak SAMEORIGIN on a site with multiple subdomains may still allow sibling subdomain attacks.
Remediation checklist
Add Content-Security-Policy: frame-ancestors 'self' or 'none' on sensitive paths. Set X-Frame-Options: DENY as defense in depth. Verify CDN does not strip security headers on HTML responses.
Retest after WAF or reverse proxy changes. Document framing policy in security architecture reviews.
Scope and limitations
We analyze HTTP headers only — not meta CSP tags in HTML body. If framing policy is set solely via meta tag, this fetch may miss it; prefer header delivery for enforcement consistency.
Redirects to a different host may serve different framing policy — test the final user-facing URL.
When security teams use clickjacking tests
Pre-release QA on authentication redesigns. Bug bounty triage when researchers report UI redress. Compliance evidence for OWASP ASVS framing controls.
Pair with mixed-content and TLS checks so embedded resources do not weaken the framed page's integrity.
Frequently Asked Questions
Yes. VSPIC offers this clickjacking test at no cost with no account required. Results load in real time.
We do not permanently store your queries on our servers. Some tools run entirely in your browser; others fetch public data for the request only.
Yes. Open the page in any modern phone or tablet browser. Results work on Wi‑Fi and mobile data.
Headers allow framing by arbitrary sites — missing X-Frame-Options and permissive or absent frame-ancestors.
SAMEORIGIN blocks external sites but allows same-site iframes. Use DENY or frame-ancestors 'none' for maximum restriction on sensitive pages.
This tool reads response headers. Meta-delivered CSP may not appear — configure framing policy via headers for reliable detection.
Only if they do not need embed widgets. Apply strict framing on auth and admin paths regardless of marketing policy.
Modern browsers block mixed content framing in many cases, but never rely on that — explicit DENY headers are required.
The headers checker scores X-Frame-Options presence. This tool evaluates clickjacking risk including CSP frame-ancestors interaction.
Next step for your check
Continue with ssl/tls grade checker on VSPIC.
Related Tools
Explore more free VSPIC tools for IP, DNS, security, and network diagnostics.
SSL/TLS Grade Checker
SSL grade, protocol support, cipher analysis, and expiry
Use Free →Security Headers Checker
HSTS, CSP grade A–F, per-header score, full header map
Use Free →CORS Checker
Check allowed origins, methods, and headers
Use Free →Mixed Content Checker
Find HTTP resources on HTTPS pages
Use Free →Cookie Analyzer
Analyze cookies — Secure, HttpOnly, SameSite flags
Use Free →Malware URL Scanner
URL reputation scan — single or batch, phishing & malware signals
Use Free →SSL Checker
Validate SSL/TLS certificates and expiration dates
Use Free →
Trusted by Users Who Value Privacy
Always Free
No premium plan ever
100% Private
Files processed in browser
Instant Results
Convert in seconds
Works Everywhere
Any device, any OS