Protect Your WordPress Site From Clickjacking Attacks by Adding the X-Frame-Options Header and Owasp's Legacy Browser Frame Breaking Script.

Andy Feliciotti

WP Anti-Clickjack is a powerful security plugin that helps prevent your WordPress site from being vulnerable to clickjacking attacks. Clickjacking is a malicious technique where an attacker tricks users into clicking on a concealed link or button by overlaying it on your legitimate website.
This plugin implements two key defense mechanisms:
<ol>
<li>
X-Frame-Options Header: The plugin adds the <code>X-Frame-Options: SAMEORIGIN</code> HTTP header to your site’s responses. This header instructs web browsers to prevent other websites from embedding your site within an iframe, effectively blocking clickjacking attempts.
</li>
<li>
OWASP’s Legacy Browser Frame Breaking Script: The plugin includes a modified version of OWASP’s legacy browser frame breaking script. This script prevents other sites from putting your site in an iframe, even in browsers that don’t support the X-Frame-Options header. The script is optimized to work seamlessly in browsers with and without JavaScript enabled.
</li>
</ol>
By combining these two security measures, WP Anti-Clickjack provides comprehensive protection against clickjacking attacks, ensuring the safety and integrity of your WordPress site.
For more information about clickjacking defense techniques, refer to the <a href="https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html" rel="nofollow ugc">OWASP Clickjacking Defense Cheat Sheet</a>.
<h4>Features</h4>
<ul>
<li>Adds the <code>X-Frame-Options: SAMEORIGIN</code> HTTP header to prevent clickjacking</li>
<li>Includes a modified version of OWASP’s legacy browser frame breaking script</li>
<li>Compatible with popular page builders and editors like Elementor, Divi, WPBakery, and more</li>
<li>Provides filters to disable the anti-clickjacking measures when needed</li>
<li>Easy to install and configure</li>
<li>Regularly updated and tested with the latest WordPress versions</li>
</ul>
<h4>Additional Details</h4>
If you need to disable the clickjacking JavaScript on a specific page, you can use the following filter in your theme’s <code>functions.php</code> file:
<pre><code>add_filter('wp_anti_clickjack', '__return_false');
</code></pre>
To disable the clickjacking X-Frame-Options HTTP header, use this filter in your theme’s <code>functions.php</code> file:
<pre><code>add_filter('wp_anti_clickjack_x_frame_options_header', '__return_false');
</code></pre>

Alternatives to WP Anti-Clickjack

Top alternatives