Skip to content
BackEsc
Sign in

Clickjacking · passage 6 of 12

Implement X-Frame-Options Header

1 code block · Clickjacking/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Open this passage on GitHub

Implement the X-Frame-Options header with the DENY or SAMEORIGIN directive to prevent your website from being embedded within an iframe without your consent.

Header always append X-Frame-Options SAMEORIGIN

Source: Clickjacking/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 12 is a mark on the map. Named now: 1 to 12, reading order first.

  1. Clickjacking§ 1text · README.md
  2. UI Redressing§ 21 code block · README.md
  3. Invisible Frames§ 3text · README.md
  4. Button/Form Hijacking§ 4text · README.md
  5. Execution Methods§ 52 code blocks · README.md
  6. Implement X-Frame-Options Header§ 61 code block · README.md
  7. Content Security Policy (CSP)§ 71 code block · README.md
  8. Disabling JavaScript§ 8text · README.md
  9. OnBeforeUnload Event§ 93 code blocks · README.md
  10. IE8 XSS filter§ 102 code blocks · README.md
  11. Chrome 4.0 XSSAuditor filter§ 111 code block · README.md
  12. Challenge§ 121 code block · README.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only. Use this via MCP

CyberSIXTSignal over noise
Updated AboutDevelopersSign in