Clickjacking Risk Calculator

Score UI redressing risk from framing controls, confirmation design and cookie policy, and estimate how many users a campaign would catch.

Inputs

Framing controls

Confirmation and intent verification

SameSite attribute on the session cookie

Sensitivity of the one-click action

Authenticated sessions per monthsessions

Share of users the lure page reaches%

Overall Risk Severity

Critical

Likelihood Score

7.33/ 9

Impact Score

8.00/ 9

Expected Victims per Month

8,148users

Risk Score

6.52/ 9

Highest-Value Fix

Send Content-Security-Policy frame-ancestors 'none' on every authenticated page

Step by step

Values used
Framing controls = No framing control — 9; Confirmation and intent verification = Single click, no confirmation — 9; SameSite attribute on the session cookie = Lax — 4; Sensitivity of the one-click action = Payment or transfer — 8; Authenticated sessions per month = 500,000 sessions; Share of users the lure page reaches = 2 %
Clickjacking Risk
Likelihood = mean(framing controls, confirmation design, SameSite attribute); impact = sensitivity of the one-click action.
Campaign yield
expected victims = monthly sessions × lure reach × likelihood ÷ 9.
Overall Risk Severity
= Critical
Likelihood Score
= 7.33 / 9
Impact Score
= 8.00 / 9
Expected Victims per Month
= 8,148 users
Risk Score
= 6.52 / 9
Highest-Value Fix
= Send Content-Security-Policy frame-ancestors 'none' on every authenticated page

How it works

Framing controls decide whether the page can be embedded at all, and SameSite decides whether the framed request even carries a session, so both sit under likelihood. The victim estimate scales your session volume by how many users the lure reaches and by the normalised likelihood that the redressed click lands. Clickjacking is dismissed as low severity until the framed button is a payment confirmation or an OAuth consent screen, and the fix is one response header.

Formulas

Clickjacking Risk

Likelihood = mean(framing controls, confirmation design, SameSite attribute); impact = sensitivity of the one-click action.

frameControl: 1 frame-ancestors 'none' … 9 no control
likelihood: 0–9 OWASP likelihood

Campaign yield

expected victims = monthly sessions × lure reach × likelihood ÷ 9.

lure reach: Share of users who load the attacker's framing page

Frequently Asked Questions

How is Clickjacking Risk calculated?

Likelihood = mean(framing controls, confirmation design, SameSite attribute); impact = sensitivity of the one-click action. Framing controls decide whether the page can be embedded at all, and SameSite decides whether the framed request even carries a session, so both sit under likelihood. The victim estimate scales your session volume by how many users the lure reaches and by the normalised likelihood that the redressed click lands.

Why does Clickjacking Risk matter?

Clickjacking is dismissed as low severity until the framed button is a payment confirmation or an OAuth consent screen, and the fix is one response header.

What values do I need to enter?

This calculator takes 6 inputs: Framing controls, Confirmation and intent verification, SameSite attribute on the session cookie, Sensitivity of the one-click action, Authenticated sessions per month, Share of users the lure page reaches. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Is X-Frame-Options still enough?

It is a legacy fallback. X-Frame-Options has no allow-list beyond a single origin, is ignored inside nested frames by some browsers, and is superseded by CSP frame-ancestors. Send frame-ancestors for current browsers and keep X-Frame-Options only for very old clients.

You might also need

CSP Effectiveness Calculator Security Header Score Calculator CSRF Risk Calculator