You click a button that says “Play,” but behind it, invisibly, you just approved something you never intended. That is clickjacking — a clever trick that hijacks your clicks by hiding the real target under a harmless-looking one. Our GetMyPassword team explains what clickjacking is, how it works, and how to avoid being caught out by it.
What clickjacking is
Clickjacking — also called a “UI redress” attack — tricks you into clicking something different from what you see. An attacker lays an invisible or disguised layer over a real page, so the button you think you are pressing is not the one that actually receives the click. You believe you tapped “Play” or “Close,” while underneath you confirmed an action the attacker wanted.
How it works
The classic method loads a legitimate page in a transparent frame and floats it over a decoy. Your cursor lands on the bait, but the click passes through to the hidden real button beneath. Because everything happens on a page that looks normal, there is often no obvious sign anything is wrong — which is what makes the trick effective.
What it can do
- Trigger actions in your name — likes, follows or posts you never meant to make.
- Grant permissions, such as access to your camera or an app connection.
- Confirm purchases or change settings without you realizing.
- Combine with other tricks to take over an account in some cases.
Clickjacking does not break in — it borrows your own click. The defense is partly the website’s job and partly a habit: be wary of pages that pile on overlays, popups and “click here to continue” buttons.
How to protect yourself
Most defense is on the website’s side — modern sites use protections that stop their pages being framed by others. As a user, keep your browser updated so those protections work, and be cautious on sketchy sites covered in overlays, fake “play” buttons and aggressive popups. As a safety net, protect your accounts so a single tricked click cannot do real harm: use a unique password from our password generator for each one and turn on two-factor authentication, which still stands between an attacker and your account.
Frequently asked questions
What is clickjacking in simple terms?
It is a trick that makes you click something different from what you see, by hiding the real target under a disguised or invisible layer. You think you click one thing, but the click goes to a hidden button the attacker placed.
How do I protect myself from clickjacking?
Keep your browser updated so site protections work, and be cautious on suspicious sites full of overlays and fake buttons. Using unique passwords and two-factor authentication limits the damage a tricked click can cause.
Is clickjacking the website’s fault or mine?
Mostly it is prevented on the website’s side with framing protections. As a user you cannot fully control it, but an updated browser and caution on sketchy pages, plus strong account security, reduce your risk.