Defaults.Exposed › October 2026 census › v10 registry › Clickjacking protection
Clickjacking protection
Methodology v10 · canonical ID x-frame-options · Web Security · scored
Stops attackers embedding your site to trick your customers into clicking things.
Clickjacking protection: definition
| Canonical ID | x-frame-options |
|---|---|
| Category | Web Security |
| Grade impact | Scored, counts toward the grade |
| Pass | The site sends X-Frame-Options (DENY/SAMEORIGIN) or a CSP (Content Security Policy) frame-ancestors directive. |
| Fail | Neither header is sent, the site can be framed by any origin. |
| Example (passing) | X-Frame-Options: DENY |
Clickjacking protection across the census
15.9% of domains whose page returned a 2xx response send clickjacking protection (X-Frame-Options or CSP frame-ancestors) (21,073,916 of 132,559,479, as of October 12, 2026).
Aggregates only: never an individual domain's result.
How this check is scored
Clickjacking protection is one of the 24 scored checks in methodology v10. It carries points toward the grade, and a pass earns them. When the result cannot be determined for a domain (a timeout, a SERVFAIL, a redacted source), the check returns N/A and drops out of that domain's scoring denominator. A result that could not be determined is never counted as a fail; a determined absence is.
In the October 2026 census, 199,932,840 of the 332,492,319 graded domains had no determinable result for this check: the four response-header checks run only where the page returned a 2xx response; redirects, errors and unanswered fetches return N/A.
Every outcome in the census
| Outcome | Domains | Share of domains whose page returned a 2xx response | In the headline figure |
|---|---|---|---|
| X-Frame-Options or CSP frame-ancestors sent | 21,073,916 | 15.9% | Yes |
| Neither sent | 111,485,563 | 84.1% | No |
Source: the October 2026 census rollup, deduplicated per domain, as of October 12, 2026.
By top-level domain
This splits the share of domains whose page returned a 2xx response that send clickjacking protection (X-Frame-Options or CSP frame-ancestors) by TLD, with generic and country-code TLDs kept apart. A TLD is named below only when at least 100,000 of its domains are in this check's base.
| Kind | Combined share | Highest | Lowest |
|---|---|---|---|
| Generic TLDs (gTLDs): 353 TLDs, 89,943,208 domains | 16.5% | .shop 34.7%, .icu 25.9%, .art 21.0% | .xyz 2.78%, .top 4.52%, .vip 7.15% |
| Country-code TLDs (ccTLDs): 167 TLDs, 42,370,451 domains | 14.7% | .ai 26.1%, .mx 25.6%, .nz 23.5% | .cc 6.31%, .se 8.04%, .cn 8.33% |
The largest TLD in this base, .com, stands at 18.0% (10,485,810 of 58,295,711).
Kind follows the IANA (Internet Assigned Numbers Authority) delegation type: every two-letter TLD is a ccTLD. The per-TLD rollup covers 132,313,659 of the 132,559,479 domains in this base. Grade shares for every TLD are on TLDs compared: the census section.
Against the other checks
Among the 6 Web Security checks with a published figure, Clickjacking protection has the 4th highest pass share. Next above it is MIME-sniffing protection: 18.7% of domains whose page returned a 2xx response. Next below it is Referrer-Policy: 8.86% of domains whose page returned a 2xx response. Across every check with a published figure it ranks 18th of 24 .
Each share is measured on the check's own base, named on its page, so the ranking compares rates across different sets of domains.
The CSP route to a pass
A frame-ancestors directive in a Content-Security-Policy also passes this check. The census CSP evidence covers the 222,969,925 domains that sent a Server, Content-Security-Policy or X-Powered-By header. 23,309,190 of them send a CSP header of any kind, and 11,956,354 of those (51.3%) include frame-ancestors.
Further reading: unsafe-inline, and frame-ancestors versus X-Frame-Options: what the web sends
Fix it
Plain-English impact, cost of ignoring it, and step-by-step remediation: How to fix Clickjacking protection
Cite this check
Defaults.Exposed, "Clickjacking protection (x-frame-options)", Grading Methodology v10 (census as of October 12, 2026). https://defaults.exposed/methodology/x-frame-options
Permalink: https://defaults.exposed/methodology/x-frame-options ·
All 33 checks: v10 registry ·
Machine-readable: /methodology/checks.json ·
Licence: open data