Score UI redressing risk from framing controls, confirmation design and cookie policy, and estimate how many users a campaign would catch.
Framing controls decide whether the page can be embedded at all, and SameSite decides whether the framed request even carries a session, so both sit under likelihood. The victim estimate scales your session volume by how many users the lure reaches and by the normalised likelihood that the redressed click lands. Clickjacking is dismissed as low severity until the framed button is a payment confirmation or an OAuth consent screen, and the fix is one response header.
Clickjacking Risk
Likelihood = mean(framing controls, confirmation design, SameSite attribute); impact = sensitivity of the one-click action.
Campaign yield
expected victims = monthly sessions × lure reach × likelihood ÷ 9.
Likelihood = mean(framing controls, confirmation design, SameSite attribute); impact = sensitivity of the one-click action. Framing controls decide whether the page can be embedded at all, and SameSite decides whether the framed request even carries a session, so both sit under likelihood. The victim estimate scales your session volume by how many users the lure reaches and by the normalised likelihood that the redressed click lands.
Clickjacking is dismissed as low severity until the framed button is a payment confirmation or an OAuth consent screen, and the fix is one response header.
This calculator takes 6 inputs: Framing controls, Confirmation and intent verification, SameSite attribute on the session cookie, Sensitivity of the one-click action, Authenticated sessions per month, Share of users the lure page reaches. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
It is a legacy fallback. X-Frame-Options has no allow-list beyond a single origin, is ignored inside nested frames by some browsers, and is superseded by CSP frame-ancestors. Send frame-ancestors for current browsers and keep X-Frame-Options only for very old clients.