# Framing Protection Trends: Defending Against Clickjacking

> Analyze the 3-year adoption trends of X-Frame-Options and CSP frame-ancestors across 1 million domains to improve your clickjacking defense strategy.

- Published: 2026-06-11T09:47:19.000Z
- Severity: info
- Category: Threat Intel
- Tags: X Frame Options, Content Security Policy, Clickjacking, Web Security, Tranco List
- Author: Runtime Rebel Intel
- Primary source: https://isc.sans.edu/diary/rss/33068
- Canonical: https://runtimerebel.com/blog/framing-protection-trends-defending-against-clickjacking

## Key points

- Adoption of framing protection headers has increased significantly across the top 1 million websites to prevent UI redressing.
- Web applications rely on X-Frame-Options and CSP frame-ancestors directives to mitigate unauthorized framing and clickjacking attacks.
- Security teams must audit web server configurations to ensure modern CSP headers are prioritized over legacy framing protections.

Clickjacking, a deceptive technique often referred to as UI redressing, remains a persistent concern for web application security. By embedding a legitimate website into an iframe and overlaying it with malicious, invisible layers, attackers can trick users into performing unintended actions. Recent research shared by [SANS ISC](https://isc.sans.edu/diary/rss/33068) provides a comprehensive look at how the top 1 million most popular domains—based on the Tranco list—have evolved their use of framing protection security headers over the past three years.

## Understanding the 2024 Security Header Landscape

Security analysts and [SOC](/glossary#soc) teams frequently audit HTTP response headers to evaluate a site's defensive posture. The primary headers used to combat framing-based attacks are X-Frame-Options (XFO) and the Content Security Policy (CSP) `frame-ancestors` directive. While both serve similar purposes, their adoption rates and implementation methods vary significantly. According to the analysis, there has been a steady increase in the use of these headers as organizations move toward more [Zero Trust](/glossary#zero-trust) inspired web configurations. 

### X-Frame-Options vs CSP frame-ancestors Comparison

When performing an **X-Frame-Options vs CSP frame-ancestors comparison**, it is clear that X-Frame-Options remains the most common choice due to its long history and simplicity. Introduced in 2009, XFO supports three primary directives: `DENY`, `SAMEORIGIN`, and the now-deprecated `ALLOW-FROM`. However, XFO lacks the granularity required for modern, complex web ecosystems. 

In contrast, the CSP `frame-ancestors` directive, part of the CSP Level 2 specification, offers much more flexibility. It allows a developer to list multiple authorized parent domains, providing a more robust defense than the single-origin limitation of XFO. Despite these benefits, the transition to CSP has been slower than expected. The data indicates that while many sites have adopted XFO, a smaller percentage have successfully implemented the more advanced CSP directive to protect against framing-based [XSS](/glossary#xss) delivery or data exfiltration.

### Detecting Clickjacking Vulnerabilities in Web Applications

For a [SIEM](/glossary#siem) or security researcher, **detecting clickjacking vulnerabilities in web applications** often starts with identifying missing or misconfigured headers. If a site lacks both XFO and CSP `frame-ancestors`, it is fundamentally susceptible to being framed by any third-party origin. This vulnerability is categorized under [MITRE ATT&CK](/glossary#mitre-att-ck) as a form of user interaction-based exploitation. 

The 2024 analysis highlights that even when headers are present, they are sometimes set to `SAMEORIGIN` by default without a deep understanding of the application's legitimate framing needs. This can lead to breaking functionality in legitimate portal or dashboard environments while still leaving gaps if the origin itself is compromised through [Lateral Movement](/glossary#lateral-movement).

## Technical Implementation and Best Practices

To ensure a resilient defense, organizations should transition from legacy headers to modern standards. Many practitioners are currently researching **how to implement CSP frame-ancestors for web security** as a replacement for XFO. The recommended approach is to provide both headers for maximum compatibility across older and modern browsers. 

1. **Prioritize CSP**: Use `Content-Security-Policy: frame-ancestors 'self' https://trusted.partner.com;`. This is more secure and supports multiple origins.
2. **Maintain XFO for Legacy Support**: Continue to use `X-Frame-Options: SAMEORIGIN` for older browsers that do not support CSP Level 2.
3. **Audit and Monitor**: Use automated tools to scan all public-facing endpoints. A [CVE](/glossary#cve) is rarely assigned for a missing header alone, but its absence is a frequent finding in high-severity penetration tests.

By staying informed on these adoption trends, security professionals can better prioritize their remediation efforts and ensure their web assets are not the next target for UI redressing campaigns.

**Related:** [Ghost CMS CVE-2022-41654: Over 700 Websites Compromised](/blog/ghost-cms-cve-2022-41654-over-700-websites-compromised), [Bot Mitigation with CAPTCHAs: Understanding Cloudflare Turnstile](/blog/bot-mitigation-with-captchas-understanding-cloudflare-turnstile)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/framing-protection-trends-defending-against-clickjacking