Securing PHP Applications Against Clickjacking Vulnerabilities

By Alessandro D.P.2 min readMarch 25, 2026

To effectively mitigate clickjacking risks, developers can employ the X-Frame-Options header and the Content Security Policy (CSP) header. These headers help control how your web application is displayed in frames, preventing unauthorized embedding and ensuring that your users interact only with the intended content.

Understanding Clickjacking

Clickjacking occurs when a malicious site overlays a transparent iframe on top of a legitimate site. Users think they're clicking on the visible content, but they're actually clicking on hidden elements that can execute harmful actions.

Example of Clickjacking

Consider a scenario where a user is tricked into clicking a button that transfers money from their account:

<!-- Malicious Website -->
<html>
<body>
    <iframe src="https://your-secure-site.com/transfer" style="opacity: 0; position: absolute; width: 100%; height: 100%;"></iframe>
    <button onclick="alert('You clicked the button!')">Click Me</button>
</body>
</html>

In the above example, the user thinks they are clicking the "Click Me" button, but they are actually triggering a transfer on the secure site.

Preventing Clickjacking

Using X-Frame-Options Header

The X-Frame-Options header is a simple yet effective way to prevent clickjacking. It can take three values:

DENY: The page cannot be displayed in a frame, regardless of the site attempting to do so.
SAMEORIGIN: The page can be displayed in a frame on the same origin as the page itself.
ALLOW-FROM uri: The page can only be displayed in a frame on the specified origin (not widely supported).

To implement this in your PHP application, you can add the following code to your scripts:

header('X-Frame-Options: DENY');

Example of X-Frame-Options Implementation

<?php
// Prevent clickjacking
header('X-Frame-Options: DENY');

// Your application logic here
?>

Using Content Security Policy (CSP)

CSP is a more flexible and powerful tool compared to X-Frame-Options. It allows you to define which sources can display your content in frames. To use CSP for clickjacking protection, you can set the frame-ancestors directive.

Example of CSP Implementation

header("Content-Security-Policy: frame-ancestors 'self'");

This header will allow your content to be framed only by pages from the same origin.

Example of Combined Implementation

You can combine both headers for enhanced security:

<?php
// Prevent clickjacking
header('X-Frame-Options: DENY');
header("Content-Security-Policy: frame-ancestors 'self'");

// Your application logic here
?>

Summary of Clickjacking Prevention Techniques

Technique	Description	Browser Support
X-Frame-Options	Prevents framing by specifying allowed origins.	All major browsers
Content Security Policy	Provides a more granular control over framing and other security policies.	Most modern browsers

Testing Your Implementation

After implementing the headers, it is crucial to test if they are working correctly. You can use browser developer tools to check the response headers:

Open your application in a web browser.
Right-click and select "Inspect" (or press F12).
Navigate to the "Network" tab.
Refresh the page and click on the request for your page.
Check the "Headers" section for X-Frame-Options and Content-Security-Policy.

Conclusion

Securing your PHP applications against clickjacking vulnerabilities is essential for protecting your users and maintaining the integrity of your application. By implementing the X-Frame-Options and Content Security Policy headers, you can significantly reduce the risk of clickjacking attacks.