What clickjacking is
Clickjacking is a web attack in which a user is tricked into clicking on something different from what they think they are clicking. The attacker arranges the page so that what the user perceives and what they actually interact with are not the same. As a result, the user's click is hijacked to perform an action they did not intend, which is where the name comes from.
How the trick works
A common way clickjacking works is by layering a hidden or disguised element over a visible one. The user sees and tries to click an innocent-looking item, but their click actually lands on something else that has been placed invisibly on top or underneath. Because the deception is visual, the user has no obvious indication that their click is being redirected to a different target.
What an attacker can achieve
Through clickjacking, an attacker can cause a user to trigger actions they did not mean to, by capturing their clicks. Since the user believes they are interacting with something harmless, they may unknowingly approve or activate something the attacker wants. This makes clickjacking a deceptive technique that abuses the gap between appearance and reality on a web page.
Why clickjacking is deceptive
What makes clickjacking particularly tricky is that it relies on misleading the user's perception rather than on any obvious technical breach the user can notice. The page looks normal, but the interaction is manipulated. Because users naturally trust what they see, this kind of visual deception can be effective, which is why clickjacking is treated as a real web security concern.
Preventing clickjacking
Defending against clickjacking generally involves preventing a page from being presented in a deceptive way by another site, so that it cannot be hidden or framed to trick users. By controlling how and whether a page can be embedded elsewhere, sites can reduce the risk of their interface being used in a clickjacking attack. These protections help keep user clicks going where users intend.
Why it matters
Clickjacking is an important web security concept to understand. Knowing what it is - tricking a user into clicking something other than what they perceive - clarifies a deceptive class of attacks that exploit appearance. For anyone interested in web security, it is a valuable concept to understand.
Related on Skillo
See also: What is cross-site scripting (XSS)? Explained, What is a content security policy? Explained.
Sources
Published date reflects the original event date (2026-04-28). This article is original Skillo editorial written from the sources above; facts were verified in September 2026.
Leave a Reply