2026-11-03 · Daily security tips

Can another site load your app inside an iframe?

Clickjacking works like this: someone loads your real app, where the user is already signed in, in an invisible iframe on their own page and places a fake button over one of yours. The user thinks they clicked theirs. They actually clicked delete, confirm or change email in your app.

Check: run curl -sI https://yoursite.com and look for a Content-Security-Policy header with frame-ancestors, or an X-Frame-Options header. If neither is there, any site can frame your pages.

Fix: send Content-Security-Policy: frame-ancestors 'self' (or 'none' if you never embed your own pages), plus X-Frame-Options: SAMEORIGIN or DENY for older browsers. Set them in vercel.json, netlify.toml, _headers or your framework's headers config.

If you embed your app somewhere on purpose, list that exact origin instead of dropping the header.