What is Clickjacking & X-Frame-Options?
A UI-redress attack that layers an invisible frame over a legitimate page to hijack clicks. The frame-ancestors CSP directive or X-Frame-Options DENY keeps sensitive pages unframeable.
Related terms
Content Security Policy
An HTTP response header that whitelists exactly which origins may supply scripts, styles, and frames. A tight policy neuters injected payloads even after an XSS bug ships.
CSP Directives
The individual rules inside a Content Security Policy, such as script-src, object-src, and frame-ancestors. Each directive narrows one resource class, so auditing means reviewing directives one by one.
Cross-Site Scripting (XSS)
An injection flaw where attacker-supplied scripts execute in a victim’s browser, stealing sessions or defacing pages. Output-encoding, framework auto-escaping, and strong CSP turn most payloads inert.
Cross-Site Request Forgery (CSRF)
An attack that tricks a logged-in browser into submitting unwanted state-changing requests to a trusted site. SameSite cookies, anti-CSRF tokens, and origin checks break the forgery chain.
SQL Injection
An attack that smuggles database commands through unsanitized input into application queries. Parameterized statements and least-privilege database roles keep hostile input as data, never executable code.
HTTP Strict Transport Security (HSTS)
A response header that obliges browsers to use HTTPS only for a domain, blocking protocol-downgrade attacks. BYOB’s Traefik edge already redirects port 80 to 443, and HSTS pins that behavior client-side.