What is clickjacking?

Clickjacking is a trick where an attacker loads your real website invisibly on top of their own page, so a visitor who thinks they are clicking the attacker’s page is actually clicking yours:

• How it works - your genuine login, payment or settings page is layered over a decoy with the opacity turned to zero; the visitor clicks what looks like a harmless button and hits your real controls underneath.
• What it can achieve - confirming a payment, changing an account setting or approving a permission, all without the visitor realising they touched your site.
• The defence - tell browsers your pages may not be embedded elsewhere, using X-Frame-Options or the frame-ancestors rule in a Content-Security-Policy.

Set X-Frame-Options to SAMEORIGIN and the overlay can never load - the whole attack depends on framing your pages.