WP Anti-Clickjack for WordPress

WP Anti-Clickjack is a powerful security plugin that helps prevent your WordPress site from being vulnerable to clickjacking attacks. Clickjacking is a malicious technique where an attacker tricks users into clicking on a concealed link or button by overlaying it on your legitimate website.

This plugin implements two key defense mechanisms:

X-Frame-Options Header: The plugin adds the X-Frame-Options: SAMEORIGIN HTTP header to your site’s responses. This header instructs web browsers to prevent other websites from embedding your site within an iframe, effectively blocking clickjacking attempts.

OWASP’s Legacy Browser Frame Breaking Script: The plugin includes a modified version of OWASP’s legacy browser frame breaking script. This script prevents other sites from putting your site in an iframe, even in browsers that don’t support the X-Frame-Options header. The script is optimized to work seamlessly in browsers with and without JavaScript enabled.

By combining these two security measures, WP Anti-Clickjack provides comprehensive protection against clickjacking attacks, ensuring the safety and integrity of your WordPress site.

For more information about clickjacking defense techniques, refer to the OWASP Clickjacking Defense Cheat Sheet.

Features

Adds the X-Frame-Options: SAMEORIGIN HTTP header to prevent clickjacking

Includes a modified version of OWASP’s legacy browser frame breaking script

Compatible with popular page builders and editors like Elementor, Divi, WPBakery, Bricks, Breakdance, Oxygen, and more

Provides filters to disable the anti-clickjacking measures when needed