Clickjacking tester

Clickjacking works by loading your page in a transparent frame on an attacker's site and laying a decoy UI on top, so a victim's click lands on your button while they aim at the decoy. The defense is a framing policy: CSP frame-ancestors (the modern control) or X-Frame-Options (the 2010-era control browsers still honor). When both are present, frame-ancestors wins wherever browsers support CSP2+, which is why this report names the governing directive instead of just listing headers. A passing result reflects the headers as sent; it does not execute the page, so cookie-gated behavior and embedded iframes carry their own policies this check never sees.