Clickjacking: the click that was not for you

Clickjacking tricks the user into clicking elements of another site, invisible because overlaid in a transparent iframe.

The trick

The attacker loads the target site in an <iframe> with opacity:0, aligning a sensitive button ("Delete account", "Authorize") over a lure ("Win a prize"). The user thinks they click the lure but clicks the real action, authenticated by their cookies.

<iframe src="https://bank.com/settings" style="opacity:0;position:absolute"></iframe>
<button>Click here!</button>  <!-- aligned under the real button -->

Defence

Prevent framing: Content-Security-Policy: frame-ancestors 'self' (modern) or X-Frame-Options: DENY/SAMEORIGIN. For critical actions, require explicit confirmation or re-authentication, which a blind click cannot satisfy.