Defaults.Exposed › Stats › Web security headers
What percent of websites block clickjacking?
As of July 28, 2026 · census snapshot 2026-07-28
As of July 28, 2026, 5.7% of the 276 million domains graded in the Defaults.Exposed census send clickjacking protection (X-Frame-Options or a frame-ancestors CSP directive) — 15,615,625 domains.
Cite this
Statistic current as of July 28, 2026. Recomputed from the live census each edition; the number on this page and the machine-readable twin always match. Please cite Defaults.Exposed and link this page.
Defaults.Exposed, "What percent of websites block clickjacking?" (as of July 28, 2026). https://defaults.exposed/stats/what-percent-of-websites-block-clickjacking
Permalink:https://defaults.exposed/stats/what-percent-of-websites-block-clickjacking · Machine-readable:clickjacking-protection.json · Licence:open data
Methodology: how we grade the internet · Source data: defaults.exposed/data. Updated with each census edition.
Related statistics
- What percent of websites have a Content-Security-Policy?
- What percent of websites set X-Content-Type-Options?
- What percent of websites set a Referrer-Policy?
- How many websites pass every security-header check?
- How many websites use cross-origin isolation headers?
- How many websites deploy HTTPS, HSTS and CSP together?