GWAPT · Question #99
Which HTTP header is MOST effective at mitigating clickjacking attacks?
The correct answer is B. X-Frame-Options. X-Frame-Options directly prevents clickjacking by telling the browser whether a page is allowed to be rendered inside a <frame>, <iframe>, or <object>. Setting it to DENY or SAMEORIGIN blocks attackers from embedding your page invisibly over their own malicious UI to trick…
Question
Which HTTP header is MOST effective at mitigating clickjacking attacks?
Options
- AContent-Type
- BX-Frame-Options
- CStrict-Transport-Security
- DSet-Cookie
How the community answered
(44 responses)- A16% (7)
- B73% (32)
- C7% (3)
- D5% (2)
Explanation
X-Frame-Options directly prevents clickjacking by telling the browser whether a page is allowed to be rendered inside a <frame>, <iframe>, or <object>. Setting it to DENY or SAMEORIGIN blocks attackers from embedding your page invisibly over their own malicious UI to trick users into clicking.
- A (Content-Type) controls how the browser interprets response data (e.g.,
text/html). It's unrelated to framing behavior. - C (Strict-Transport-Security / HSTS) forces HTTPS connections, defending against protocol downgrade attacks - not framing.
- D (Set-Cookie) governs cookie transmission rules (e.g.,
HttpOnly,Secure). It can limit session theft but does nothing to prevent page embedding.
Memory tip: Think "X-Frame = X out the frame" - the header literally crosses out the ability to frame your page, which is the exact mechanism clickjacking exploits.
Community Discussion
No community discussion yet for this question.