Browser & Web Performance · Middle · Question 55 of 75

What is clickjacking and which header defends against it?

✓Correct answer: Your page is loaded in a hidden iframe to trick users into clicking; Content-Security-Policy: frame-ancestors blocks unwanted framing
2Stealing clicks through ad networks; Referrer-Policy blocks them
3Fake buttons injected via XSS; X-XSS-Protection blocks them

Explanation

frame-ancestors 'none' or 'self' is the modern option; X-Frame-Options: DENY is the older equivalent.

Further reading

Test yourself

Take the Browser & Web Performance · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.