Page vulnerable to clickjacking: what it is, why it matters, and how to fix it
Neither X-Frame-Options header nor CSP frame-ancestors directive is set, leaving the page vulnerable to clickjacking attacks where it can be embedded in a malicious iframe.
Where this fits: security in SEO
Why page vulnerable to clickjacking hurts your rankings
Clickjacking attacks trick users into clicking hidden elements by overlaying your page in an invisible iframe on a malicious site. This can lead to unauthorized actions, credential theft, or social engineering. Both X-Frame-Options and CSP frame-ancestors prevent framing by untrusted origins.
This is a high-severity issue: it directly suppresses rankings or click-through on the pages it affects. It belongs in your current sprint, prioritised by how many pages carry it.
How to fix it
Add X-Frame-Options: DENY (or SAMEORIGIN if framing by your own origin is needed) and/or a CSP frame-ancestors directive. Using both provides defense in depth for older and newer browsers.
X-Frame-Options: DENY
Content-Security-Policy: frame-ancestors 'none';Frequently asked questions
What does "Page vulnerable to clickjacking" mean?
Neither X-Frame-Options header nor CSP frame-ancestors directive is set, leaving the page vulnerable to clickjacking attacks where it can be embedded in a malicious iframe.
Why does page vulnerable to clickjacking matter for SEO?
Clickjacking attacks trick users into clicking hidden elements by overlaying your page in an invisible iframe on a malicious site. This can lead to unauthorized actions, credential theft, or social engineering. Both X-Frame-Options and CSP frame-ancestors prevent framing by untrusted origins.
How do I fix page vulnerable to clickjacking?
Add X-Frame-Options: DENY (or SAMEORIGIN if framing by your own origin is needed) and/or a CSP frame-ancestors directive. Using both provides defense in depth for older and newer browsers.
How serious is this issue?
This is a high-severity issue: it directly suppresses rankings or click-through on the pages it affects. It belongs in your current sprint, prioritised by how many pages carry it. It belongs to the security family of checks.
How do I find every page affected by this on my site?
Run a free Dr Urls audit: it crawls your site, detects page vulnerable to clickjacking on every affected page, shows example URLs, and generates a ready-to-use fix task. Re-scan after fixing to verify the issue is gone.
Does your site have this issue?
A free Dr Urls audit crawls your site, finds every page affected by page vulnerable to clickjacking, and hands you a ready-made fix task.
Check my site free