# Clickjacking Attacks and How to Prevent Them **URL:** \ **Category:** Blog Discussions\ **Created:** [October 30, 2020, 2:31pm UTC](https://community.auth0.com/t/clickjacking-attacks-and-how-to-prevent-them/52476 "2020-10-30T14:31:00Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![robertino.calcaterra](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/robertino.calcaterra/32/66825_2.png) [@robertino.calcaterra](https://community.auth0.com/u/robertino.calcaterra)\ **Post date:** [October 30, 2020, 2:31pm UTC](https://community.auth0.com/t/clickjacking-attacks-and-how-to-prevent-them/52476/1 "2020-10-30T14:31:00Z")
Learn how clickjacking attacks implement visual tricks to capture users’ clicks, and how you can prevent them by applying client-side and server-side solutions. [Read more…](https://auth0.com/blog/preventing-clickjacking-attacks/) Brought for you by @andrea.chiarelli ![Clickjacking Attacks and How to Prevent Them](https://global.discourse-cdn.com/auth0/original/3X/a/1/a1d534edc131ef24fb505be48335683b67d0b12b.jpeg) ---
**Author:** ![robertino.calcaterra](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/robertino.calcaterra/32/66825_2.png) [@robertino.calcaterra](https://community.auth0.com/u/robertino.calcaterra)\ **Post date:** [October 30, 2020, 4:00pm UTC](https://community.auth0.com/t/clickjacking-attacks-and-how-to-prevent-them/52476/2 "2020-10-30T16:00:29Z")
Let us know if you have any questions in the comments below! 🗣 ---
**Author:** ![andrea.chiarelli](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/andrea.chiarelli/32/16034_2.png) [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Post date:** [October 30, 2020, 5:47pm UTC](https://community.auth0.com/t/clickjacking-attacks-and-how-to-prevent-them/52476/3 "2020-10-30T17:47:18Z")
Share your thoughts about clickjacking attacks and defenses 💪 ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [May 1, 2021, 4:00pm UTC](https://community.auth0.com/t/clickjacking-attacks-and-how-to-prevent-them/52476/6 "2021-05-01T16:00:54Z")
This topic was automatically closed after 58 days. New replies are no longer allowed. ---
**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\ **Post date:** [December 15, 2021, 3:58pm UTC](https://community.auth0.com/t/clickjacking-attacks-and-how-to-prevent-them/52476/7 "2021-12-15T15:58:09Z")
---
**Author:** ![cameron\_martens\_rrez](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/cameron_martens_rrez/32/33462_2.png) [@cameron\_martens\_rrez](https://community.auth0.com/u/cameron_martens_rrez)\ **Post date:** [December 6, 2022, 8:11pm UTC](https://community.auth0.com/t/clickjacking-attacks-and-how-to-prevent-them/52476/8 "2022-12-06T20:11:46Z")
There’s a mistake in the article: Where it talks about combining the `X-Frame-Options` and `Content-Security-Policy` headers, the article says “If both headers are specified, `X-Frame-Options` takes priority.” This is the exact opposite of what the link to the spec says: “If a resource is delivered with a policy that includes a directive named `frame-ancestors` and whose disposition is `enforce`, then the `X-Frame-Options` header will be ignored.” ---
**Author:** ![andrea.chiarelli](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/andrea.chiarelli/32/16034_2.png) [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Post date:** [December 7, 2022, 10:48am UTC](https://community.auth0.com/t/clickjacking-attacks-and-how-to-prevent-them/52476/9 "2022-12-07T10:48:56Z")
Hi @cameron_martens_rrez, Thank you very much for noticing and reporting this mistake. 🙏 I corrected the article. BTW, welcome to the Auth0 Community! 👋 ---
**Author:** ![mmikulski](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mmikulski/32/48770_2.png) [@mmikulski](https://community.auth0.com/u/mmikulski)\ **Post date:** [January 23, 2024, 1:40pm UTC](https://community.auth0.com/t/clickjacking-attacks-and-how-to-prevent-them/52476/10 "2024-01-23T13:40:29Z")
Andrea, thank you for this detailed writeup; I know its been a couple of years since you put it together, but it was really helpful for someone unaware of ‘clickjacking.’ Have there been any new developments on this front in the past few years, that would cause a defense to diverge significantly from what you describe here? ---
**Author:** ![andrea.chiarelli](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/andrea.chiarelli/32/16034_2.png) [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Post date:** [January 23, 2024, 2:36pm UTC](https://community.auth0.com/t/clickjacking-attacks-and-how-to-prevent-them/52476/11 "2024-01-23T14:36:08Z")
Hi @mmikulski, Welcome to the Auth0 Community, and thank you for appreciating my blog post. As far as I know, the core concepts behind clickjacking attacks and clickjacking defense are still valid. Anyway, the primary resource for updates is the [OWASP website](https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html). ---
**Author:** ![kyogendranathreddy](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kyogendranathreddy/32/51345_2.png) [@kyogendranathreddy](https://community.auth0.com/u/kyogendranathreddy)\ **Post date:** [April 23, 2024, 11:46am UTC](https://community.auth0.com/t/clickjacking-attacks-and-how-to-prevent-them/52476/12 "2024-04-23T11:46:52Z")
Hi andrea,so I tried to prevent clickjacking by using DENY option in X-Frame-Options it’s not working,then I tried with CSP that one is also not working,can you please help me with this. ---
**Author:** ![andrea.chiarelli](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/andrea.chiarelli/32/16034_2.png) [@andrea.chiarelli](https://community.auth0.com/u/andrea.chiarelli)\ **Post date:** [April 29, 2024, 5:25pm UTC](https://community.auth0.com/t/clickjacking-attacks-and-how-to-prevent-them/52476/13 "2024-04-29T17:25:17Z")
Hey @kyogendranathreddy, Are you having problems with the example application attached to the article or in your own application? In the latter case, please make sure that the browser receives the headers correctly by inspecting the HTTP responses.