Clickjacking Risk Calculator

Score UI redressing risk from framing controls, confirmation design and cookie policy, and estimate how many users a campaign would catch.

About Clickjacking Risk Calculator

Framing controls decide whether the page can be embedded at all, and SameSite decides whether the framed request even carries a session, so both sit under likelihood. The victim estimate scales your session volume by how many users the lure reaches and by the normalised likelihood that the redressed click lands. Clickjacking is dismissed as low severity until the framed button is a payment confirmation or an OAuth consent screen, and the fix is one response header.

Formulas

Clickjacking Risk

Likelihood = mean(framing controls, confirmation design, SameSite attribute); impact = sensitivity of the one-click action.

frameControl: 1 frame-ancestors 'none' … 9 no control
likelihood: 0–9 OWASP likelihood

Campaign yield

expected victims = monthly sessions × lure reach × likelihood ÷ 9.

lure reach: Share of users who load the attacker's framing page

Worked example

With the default values below, Clickjacking Risk Calculator returns Overall Risk Severity of Critical. Change any input above and every figure here is recalculated in your browser.

Inputs used

Framing controlsone of CSP frame-ancestors 'none' — 1, frame-ancestors with an allow-list — 2, X-Frame-Options only, legacy — 5, No framing control — 9: No framing control — 9
Confirmation and intent verificationone of Re-authentication or typed confirmation — 1, Modal confirmation with distinct wording — 4, Single click, no confirmation — 9: Single click, no confirmation — 9
SameSite attribute on the session cookieone of Strict — 1, Lax — 4, None — 9: Lax — 4
Sensitivity of the one-click actionone of Read-only content — 2, Preference toggle — 5, Payment or transfer — 8, Permission grant or account deletion — 9: Payment or transfer — 8
Authenticated sessions per monthaccepts 1–1,000,000,000 sessions: 500,000 sessions
Share of users the lure page reachesaccepts 0–100 %: 2 %

Results

Overall Risk Severity: Critical
Likelihood Score: 7.33 / 9
Impact Score: 8.00 / 9
Expected Victims per Month: 8,148 users
Risk Score: 6.52 / 9
Highest-Value Fix: Send Content-Security-Policy frame-ancestors 'none' on every authenticated page

Step by step

1Values used
2Clickjacking Risk
3Campaign yield
4Overall Risk Severity= Critical
5Likelihood Score= 7.33 / 9
6Impact Score= 8.00 / 9
7Expected Victims per Month= 8,148 users
8Risk Score= 6.52 / 9
9Highest-Value Fix= Send Content-Security-Policy frame-ancestors 'none' on every authenticated page

Assumptions and limits

The result is derived only from the 6 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Clickjacking Risk calculated?

Likelihood = mean(framing controls, confirmation design, SameSite attribute); impact = sensitivity of the one-click action. Framing controls decide whether the page can be embedded at all, and SameSite decides whether the framed request even carries a session, so both sit under likelihood. The victim estimate scales your session volume by how many users the lure reaches and by the normalised likelihood that the redressed click lands.

Why does Clickjacking Risk matter?

Clickjacking is dismissed as low severity until the framed button is a payment confirmation or an OAuth consent screen, and the fix is one response header.

What values do I need to enter?

This calculator takes 6 inputs: Framing controls, Confirmation and intent verification, SameSite attribute on the session cookie, Sensitivity of the one-click action, Authenticated sessions per month, Share of users the lure page reaches. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Is X-Frame-Options still enough?

It is a legacy fallback. X-Frame-Options has no allow-list beyond a single origin, is ignored inside nested frames by some browsers, and is superseded by CSP frame-ancestors. Send frame-ancestors for current browsers and keep X-Frame-Options only for very old clients.