Missing Anti-clickjacking Header

Clickjacking is a type of attack that tricks users into clicking on something they didn't intend to click on. The attacker usually accomplishes this by overlaying a transparent layer on top of a legitimate website, so when the user tries to click on something, they're actually clicking on the attacker's hidden content.

One way to protect your web application against clickjacking attacks is to add an anti-clickjacking header to your HTTP responses. This header tells web browsers to block any attempts to embed your website in a frame or iframe, which is the most common way that clickjacking attacks are carried out.

If your vulnerability scanner has identified a missing anti-clickjacking header, it means that your website is not currently protected against clickjacking attacks. In this guide, we'll walk you through the steps to add an anti-clickjacking header to your website's HTTP responses.

‍

Step 1: Determine which web server you're using

The exact steps to add an anti-clickjacking header will depend on which web server you're using. If you're not sure which web server you're using, you can usually find out by looking at your hosting provider's documentation or by contacting their support team.

Here are some common web servers and the configuration files you'll need to modify:

• Apache: .htaccess or httpd.conf
• Nginx: nginx.conf
• Microsoft IIS: web.config

‍

Step 2: Add the X-Frame-Options header to your HTTP responses

To add an anti-clickjacking header to your website, you'll need to add the X-Frame-Options header to your HTTP responses. This header has three possible values:

• DENY: Prevents any website from embedding your website in a frame or iframe.
• SAMEORIGIN: Allows your website to be embedded in a frame or iframe only if the requesting website is from the same origin as your website.
• ALLOW-FROM uri: Allows your website to be embedded in a frame or iframe only if the requesting website is the specified URI.

‍

Here's an example of how to add the X-Frame-Options header to an Apache .htaccess file:

Header always append X-Frame-Options SAMEORIGIN

‍

Here's an example of how to add the X-Frame-Options header to an Nginx configuration file:

add_header X-Frame-Options SAMEORIGIN;

‍

And here's an example of how to add the X-Frame-Options header to a Microsoft IIS web.config file:

<system.webServer> <httpProtocol> <customHeaders> <add name="X-Frame-Options" value="SAMEORIGIN" /> </customHeaders> </httpProtocol> </system.webServer>

‍

Step 3: Test your website

Once you've added the X-Frame-Options header to your website, it's a good idea to test it to make sure it's working correctly. There are a few tools you can use to test your website for clickjacking vulnerabilities:

• OWASP ZAP: An open-source web application security scanner that includes a clickjacking test.
• Burp Suite: A web application security testing tool that includes a clickjacking test.
• Clickjacking Test: A free online tool that lets you test your website for clickjacking vulnerabilities.

Run one or more of these tests to verify that your website is no longer vulnerable to clickjacking attacks.

‍

Step 4: Update your website's security policy

Adding an anti-clickjacking header to your website is an important security measure, but it's not the only one you should take. You should also update your website's security policy to reflect your new security measures.

Your security policy should include details about how you're protecting your website from clickjacking attacks, as well as any other security measures you've implemented. You should also include instructions for your developers on how to maintain and update your website's security measures in the future.

‍

Step 5: Monitor your website for new vulnerabilities

Even with an anti-clickjacking header and other security measures in place, it's important to stay vigilant for new vulnerabilities that may be discovered in the future. You should regularly scan your website for vulnerabilities using a vulnerability scanner, and stay up-to-date on security news and best practices.

If you do discover a new vulnerability in your website, be sure to address it as quickly as possible to protect your users and your business.

‍

Conclusion

Adding an anti-clickjacking header to your website is an important step in protecting your users from clickjacking attacks. By following the steps outlined in this guide, you can add this header to your website's HTTP responses and test it to make sure it's working correctly. Remember to also update your website's security policy and stay vigilant for new vulnerabilities in the future. By taking these steps, you can help keep your website and your users safe from cyber attacks.

‍