Clickjacking is a trick that makes a person click something different from what they think they are clicking. An attacker places a transparent or disguised layer over a legitimate button, video or page, so a harmless-looking click may approve a payment, change an account setting, grant a browser permission or follow an attacker-controlled account. This guide explains how the attack works, where it shows up and what businesses can do about it.
TL;DR
- Clickjacking hides a real button or control beneath a harmless-looking webpage element.
- The victim is not tricked into typing a password; they are tricked into clicking a real control they cannot see.
- It can change settings, grant permissions, enable a webcam or make a social-media action appear to come from the victim.
- Website owners stop it with browser rules that prevent their pages being embedded in hostile sites.
- Staff still need to recognise the warning signs: unexpected login prompts, browser permission requests and buttons that do not match the action promised.
How clickjacking works
The attacker creates a convincing page — a competition, a video, a fake download button or a customer survey — and embeds a genuine page or control in an invisible frame above or below it. The visible page tells the visitor to click “play”, “continue” or “claim offer”. The invisible layer receives the click instead.
The key difference from a fake-login-page scam is that clickjacking can use a real site and a real action. The victim may already be signed in to the underlying service, so the click happens with their existing permissions. That is why a single click can be enough to authorise a setting change.
What attackers try to make people click
| Hidden action | Potential result |
|---|---|
| Browser permission prompt | Microphone, camera, notification or location access granted |
| Account-setting button | Recovery email, forwarding rule or privacy setting changed |
| Social action | Follow, like, share or app authorisation performed from the victim's account |
| Purchase or payment control | An unwanted subscription or transaction approved |
| Security-setting control | A security feature disabled or an attacker app authorised |
A common version uses a fake video player with a large play button. The page design makes clicking feel natural; the invisible layer turns that click into a different action. Another uses a fake “verify you are human” screen to persuade people to grant browser notifications, then uses those notifications to send scams that look like operating-system alerts.
Why clickjacking still matters
Browsers and major websites have made clickjacking harder than it was a decade ago, but the attack has not disappeared. It survives where sites allow themselves to be embedded in frames, where users are signed in, and where the target action has no final confirmation. It also overlaps with more familiar attacks: a phishing email drives the person to the malicious page, then clickjacking turns one careless click into an account or permission change.
That is why it belongs in the same staff training programme as phishing, not as an obscure web-developer issue. The initial lure still arrives through email, chat or a social post; the victim sees a prompt that does not match the promised task and has to stop.
Warning signs for staff
- A page asks for camera, microphone, notifications or location access when those permissions make no sense for the task.
- The browser address bar changes or a login prompt appears after clicking a video, quiz, download or competition.
- A button's visible label says one thing but the browser's status, dialog or next screen suggests another.
- The page uses urgency: “click now”, “verify immediately” or “you have one chance”.
- A security prompt appears inside a web page rather than in the browser's normal interface.
- The site looks right, but the address does not match the company or service supposedly behind the offer.
The simple rule is: do not grant a permission or approve a prompt that was not expected before opening the page. Close the tab and start again from the official site.
How website owners prevent clickjacking
The primary fix sits with the website owner, not the visitor. Pages that contain account settings, payments, login flows or sensitive data should tell browsers not to show them inside another website's frame. The widely used methods are the frame-ancestors setting in a Content Security Policy and the X-Frame-Options response header. These controls prevent a hostile site from placing the genuine page behind a fake button.
Other practical controls are:
- Require confirmation for high-risk actions. A visible summary and a second click before payments, permission grants or security changes gives the user a chance to notice.
- Re-authenticate before sensitive changes. A stale logged-in session should not be enough to change recovery details or authorise an application.
- Use clear permission language. “Allow notifications” should never be dressed up as “continue” or “watch”.
- Test the real customer flows. Security headers can be absent on one legacy route while the rest of the site is protected.
- Monitor browser permissions and connected applications. Unexpected permissions or applications linked to staff accounts should be investigated quickly.
For a small business, a security gap assessment is the practical starting point: it identifies whether web controls, access controls and staff awareness are working together rather than assuming one tool covers the lot.
How staff can reduce the risk
- Open banking, payroll, government and cloud-service portals from a saved bookmark or by typing the address, not from a message link.
- Decline unexpected browser permission requests. A page can be revisited later through the official service if the permission is genuinely needed.
- Use MFA. It will not stop every clickjacking action, but it limits the damage when an attacker tries to use a changed password or linked application.
- Report unexpected prompts and suspicious pages promptly. Human risk reporting makes it possible to see where risky behaviour is clustering across a team.
- Run realistic simulations. Security awareness training builds the pause-and-check habit before real money or data is involved.
Why this matters for Australian businesses
The Australian Signals Directorate's Annual Cyber Threat Report 2024-25 recorded more than 84,700 cybercrime reports in 2024-25, with an average self-reported cost of $56,600 for a small business incident. Clickjacking is seldom reported as the headline event; it is the quiet mechanism that can grant access, change settings or deliver a victim to the next stage of an attack.
The practical defence is the same human control that defeats many other social-engineering attacks: stop when the screen asks for an action that does not match the task. KnowBe4's 2026 phishing benchmark, built on 67.7 million simulated phishing tests, measured susceptibility falling from 33.2% before training to 4.2% after twelve months of sustained training. The browser-permission and deceptive-button moments in clickjacking are exactly the moments that repetition teaches staff to question.
FAQ
What is clickjacking in simple terms? It is hiding a real button or control behind something harmless-looking so your click does something you did not intend.
Is clickjacking the same as phishing? No. Phishing lures someone to a deceptive message or page; clickjacking hijacks the click once they arrive. The two attacks are often used together.
Can clickjacking steal a password? Not usually by itself. It can make someone approve an action while they are already signed in, or lead them into a fake login flow. MFA and browser protections limit the damage.
How do I protect my website from clickjacking? Use browser rules that prevent important pages from being embedded in other sites, require confirmation for sensitive actions and test account, payment and permission flows regularly.
What should an employee do after clicking a suspicious button? Close the page, report it to the IT or security contact, and check browser permissions and account activity from the official service. Change the password if a login was entered on the page.
One last thing
The best staff defence takes three seconds: if a page asks for a permission, login or confirmation that was not expected before opening it, stop. Close the tab and go to the official website directly.