Page vulnerable to clickjacking — the fix
Neither X-Frame-Options header nor CSP frame-ancestors directive is set, leaving the page vulnerable to clickjacking attacks where it can be embedded in a malicious iframe.
Where this fits: security in SEO
Security issues erode both rankings and trust. HTTPS has been a ranking signal since 2014, and browsers actively warn users away from insecure or mixed-content pages — a warning interstitial is a 100% bounce rate. Missing security headers rarely block indexing, but they widen your attack surface, and a hacked site (injected spam, malicious redirects) can be removed from results entirely. Security is the SEO work you do so you never have to do recovery work.
Why page vulnerable to clickjacking hurts your rankings
Clickjacking attacks trick users into clicking hidden elements by overlaying your page in an invisible iframe on a malicious site. This can lead to unauthorized actions, credential theft, or social engineering. Both X-Frame-Options and CSP frame-ancestors prevent framing by untrusted origins.
This is a high-severity issue: it directly suppresses rankings or click-through on the pages it affects. It belongs in your current sprint, prioritised by how many pages carry it.
How to fix it
Add X-Frame-Options: DENY (or SAMEORIGIN if framing by your own origin is needed) and/or a CSP frame-ancestors directive. Using both provides defense in depth for older and newer browsers.
X-Frame-Options: DENY
Content-Security-Policy: frame-ancestors 'none';Security best practices
- Serve everything over HTTPS and redirect HTTP with a single 301.
- Send HSTS, X-Content-Type-Options, and a Content-Security-Policy on every response.
- Eliminate mixed content — one insecure asset breaks the padlock.
- Keep dependencies and CMS plugins patched; most site hacks are known-CVE exploits.
- Monitor Search Console's security section — Google often knows you're hacked before you do.
The full library: SEO best practices, by category.
Frequently asked questions
What does "Page vulnerable to clickjacking" mean?
Neither X-Frame-Options header nor CSP frame-ancestors directive is set, leaving the page vulnerable to clickjacking attacks where it can be embedded in a malicious iframe.
Why does page vulnerable to clickjacking matter for SEO?
Clickjacking attacks trick users into clicking hidden elements by overlaying your page in an invisible iframe on a malicious site. This can lead to unauthorized actions, credential theft, or social engineering. Both X-Frame-Options and CSP frame-ancestors prevent framing by untrusted origins.
How do I fix page vulnerable to clickjacking?
Add X-Frame-Options: DENY (or SAMEORIGIN if framing by your own origin is needed) and/or a CSP frame-ancestors directive. Using both provides defense in depth for older and newer browsers.
How serious is this issue?
This is a high-severity issue: it directly suppresses rankings or click-through on the pages it affects. It belongs in your current sprint, prioritised by how many pages carry it. It belongs to the security family of checks.
How do I find every page affected by this on my site?
Run a free Dr Urls audit: it crawls your site, detects page vulnerable to clickjacking on every affected page, shows example URLs, and generates a ready-to-use fix task. Re-scan after fixing to verify the issue is gone.
Does your site have this issue?
A free Dr Urls audit crawls your site, finds every page affected by page vulnerable to clickjacking, and hands you a ready-made fix task.
Check my site free