Defaults.Exposed › Stats › Web security headers
What percent of websites block clickjacking?
October 2026 census edition
As of October 12, 2026, 15.9% of the 133 million domains that served a web page in the Defaults.Exposed census send clickjacking protection (X-Frame-Options or a frame-ancestors CSP directive), 21,073,916 domains.
Clickjacking protection: how it is measured
It comes from the per-check pass, which runs every graded domain through the full check battery and records a pass, a fail or an undetermined result for each check independently. Every domain in the census is measured directly and counted once.
Either X-Frame-Options or a frame-ancestors directive satisfies this check, since both prevent a page being embedded in someone else’s. It is counted as one control because the attack is one attack, and a site that has either is protected regardless of which mechanism it chose.
The denominator under that share is 133 million: the population where this particular check had something to read. A domain the census could not decide on is recorded as undetermined and left out of it, never counted as a failure.
It moves when sites add or drop response headers. These are the cheapest controls the census measures, usually one line of server or CDN (Content Delivery Network) configuration. Adoption stays low because a site without them loads and works exactly as it does with them. The number is recomputed from the raw evidence at every edition. What it cannot tell you is where one particular domain stands: for that, see what the headers do.
the full grading methodology · the underlying dataset, published open with the counts behind every percentage. If a figure here disagrees with one elsewhere on the site, the dataset is canonical and we would like to know.
Clickjacking protection: how to cite it
Please cite Defaults.Exposed and link this page. The citation below carries the date.
Defaults.Exposed, "What percent of websites block clickjacking?" (as of October 12, 2026). https://defaults.exposed/stats/what-percent-of-websites-block-clickjacking
Permalink: https://defaults.exposed/stats/what-percent-of-websites-block-clickjacking · Machine-readable: /stats/s/clickjacking-protection.json · Licence: open data
Methodology: how we grade the internet · Source data: census data and downloads. Updated with each census edition.