WP Anti-Clickjack

Description

WP Anti-Clickjack is a powerful security plugin that helps prevent your WordPress site from being vulnerable to clickjacking attacks. Clickjacking is a malicious technique where an attacker tricks users into clicking on a concealed link or button by overlaying it on your legitimate website.

This plugin implements two key defense mechanisms:

1. Frame protection headers: The plugin adds the X-Frame-Options: SAMEORIGIN and Content-Security-Policy: frame-ancestors 'self' HTTP headers to your site’s pages. They instruct web browsers to prevent other websites from embedding your site within an iframe, effectively blocking clickjacking attempts. A Content-Security-Policy your site already sends is left in place, and WordPress post embeds stay embeddable on other sites.

2. OWASP’s Legacy Browser Frame Breaking Script: The plugin includes a modified version of OWASP’s legacy browser frame breaking script. This script prevents other sites from putting your site in an iframe, even in browsers that don’t support the X-Frame-Options header. The script is optimized to work seamlessly in browsers with and without JavaScript enabled.

By combining these two security measures, WP Anti-Clickjack provides comprehensive protection against clickjacking attacks, ensuring the safety and integrity of your WordPress site.

For more information about clickjacking defense techniques, refer to the OWASP Clickjacking Defense Cheat Sheet.

Features

• Adds the X-Frame-Options: SAMEORIGIN and Content-Security-Policy: frame-ancestors 'self' HTTP headers to prevent clickjacking
• Works alongside your existing Content-Security-Policy, including nonce-based policies, and keeps framing headers your server or another plugin already sends
• Settings > Anti-Clickjack screen to let sites you choose (like your other domains or a partner) frame your site, also available as the wp_anti_clickjack_allowed_origins filter
• Site Health check that loads your homepage like a visitor and warns if a page cache, CDN or server setting drops or duplicates the headers
• « Check from outside » button that has ClickJack Test load your homepage from the internet, through your CDN, and shows what it sees
• « Test your site » link on the Plugins screen
• Includes a modified version of OWASP’s legacy browser frame breaking script
• Compatible with popular page builders and editors like Elementor, Divi, WPBakery, Bricks, Breakdance, Oxygen, and more
• Provides filters to disable the anti-clickjacking measures when needed
• Easy to install and configure
• Regularly updated and tested with the latest WordPress versions

Additional Details

To disable the clickjacking JavaScript, use the following filter in your theme’s functions.php file. It receives true or false and runs last, so you can also return false only on specific pages:

add_filter('wp_anti_clickjack', '__return_false');

To disable the clickjacking HTTP headers (X-Frame-Options and Content-Security-Policy: frame-ancestors), use this filter in your theme’s functions.php file:

add_filter('wp_anti_clickjack_x_frame_options_header', '__return_false');

To let other sites put your site in a frame, add them under Settings > Anti-Clickjack, one per line. Developers can use this filter instead (it also receives the sites saved in the settings). Wildcards work for subdomains, and the frame breaking script allows the same sites:

add_filter( 'wp_anti_clickjack_allowed_origins', function ( $origins ) {
    $origins[] = 'https://partner.example';
    $origins[] = 'https://*.example.com';
    return $origins;
} );

If your WordPress admin runs on a different domain than your site, that domain is allowed automatically so page builders and previews keep working.

Page builder and editor previews are detected only for logged-in users who can edit posts, so a visitor cannot switch the protection off by adding a page builder parameter to a URL.

If your server, CDN or another plugin already sends an X-Frame-Options header or a frame-ancestors policy, the plugin leaves them as they are and doesn’t add its own.

External services

The « Check from outside » button and the « Test your site » link use ClickJack Test, a free clickjacking tester. Nothing is sent unless an administrator clicks one of them. When they do, your homepage address is sent to clickjacktest.com, which requests that address from the internet and reports the framing headers it receives. No other data about your site or its users is sent. See ClickJack Test’s terms of use and privacy policy.