# Clickjacking for Classic Universal Login **URL:** \ **Category:** Get Help\ **Tags:** attack-protection, general-attack-protection\ **Created:** [August 15, 2023, 9:26pm UTC](https://community.auth0.com/t/clickjacking-for-classic-universal-login/113698 "2023-08-15T21:26:23Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![matthewyoung245](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@matthewyoung245](https://community.auth0.com/u/matthewyoung245)\ **Post date:** [August 15, 2023, 9:26pm UTC](https://community.auth0.com/t/clickjacking-for-classic-universal-login/113698/1 "2023-08-15T21:26:24Z")
I am using the classic universal login and wasn’t sure if I needed to turn migrations on to prevent clickjacking. I think I’m getting confused if it needs to be enabled or not because of this link. > **[Clickjacking Protection for Universal Login Change](https://auth0.com/docs/troubleshoot/product-lifecycle/past-migrations/clickjacking-protection-for-universal-login)** > > Describes how Auth0 is adding a way to prevent the Universal Login pages from being embedded into an iframe to protect against clickjacking attacks. ![image](https://global.discourse-cdn.com/auth0/original/3X/d/5/d5ac6b531b95a64835bf842875c67bca831e20f4.png) Also, where would I find x options in the network tab with this quickstart app? > > > //github.com/auth0-samples/auth0-php-web-app/tree/main/app ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [August 15, 2023, 10:16pm UTC](https://community.auth0.com/t/clickjacking-for-classic-universal-login/113698/3 "2023-08-15T22:16:10Z")
Hey there @matthewyoung245! > [@matthewyoung245](#): > > I am using the classic universal login and wasn’t sure if I needed to turn migrations on to prevent clickjacking. If you want clickjacking protection, leave the toggle off. If you don’t (or need to load in an iframe) then you will want to toggle it on and therefore forego the security headers. > [@matthewyoung245](#): > > Also, where would I find x options in the network tab with this quickstart app? You should be able to see any security headers in the network tab if you choose a specific request and then “headers”. Hope this helps to clarify! ---
**Author:** ![matthewyoung245](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@matthewyoung245](https://community.auth0.com/u/matthewyoung245)\ **Post date:** [August 16, 2023, 2:40pm UTC](https://community.auth0.com/t/clickjacking-for-classic-universal-login/113698/4 "2023-08-16T14:40:26Z")
Thank you @ty.frith Will the whole application be protected from clickjacking? For example, I log into the application and I go to another page within that same application. ---
**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\ **Post date:** [August 16, 2023, 11:26pm UTC](https://community.auth0.com/t/clickjacking-for-classic-universal-login/113698/5 "2023-08-16T23:26:37Z")
Hey @matthewyoung245 no problem, happy to help! > [@matthewyoung245](#): > > Will the whole application be protected from clickjacking? The clickjacking feature is specific to Universal Login only. ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [August 30, 2023, 11:27pm UTC](https://community.auth0.com/t/clickjacking-for-classic-universal-login/113698/6 "2023-08-30T23:27:04Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.