Your files stay on your device

Clickjacking tester

Fetches a URL's headers through the proxy and rules whether the page can be framed by reading CSP frame-ancestors and X-Frame-Options together, naming which directive governs.

Press the button to read the headers
Nothing leaves this page until you do. The report reads CSP frame-ancestors and X-Frame-Options together, names the directive that actually governs, and warns about the values that look protective but are not.

Clickjacking works by loading your page in a transparent frame on an attacker's site and laying a decoy UI on top, so a victim's click lands on your button while they aim at the decoy. The defense is a framing policy: CSP frame-ancestors (the modern control) or X-Frame-Options (the 2010-era control browsers still honor). When both are present, frame-ancestors wins wherever browsers support CSP2+, which is why this report names the governing directive instead of just listing headers. A passing result reflects the headers as sent; it does not execute the page, so cookie-gated behavior and embedded iframes carry their own policies this check never sees.
Options

More network tools

- HTTP header parser (/web/headers)
All network tools (/network)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/network/clickjacking-protection-tester
Markdown version: https://nutter.tools/network/clickjacking-protection-tester.md
Plain-text version: https://nutter.tools/network/clickjacking-protection-tester.txt
Agent index: https://nutter.tools/llms.txt