Came across this question in SE How does this test prove my application is vulnerable to clickjacking attacks? I have a follow-up question and doubt, please help me to clear it.
<html> <head> <title>Clickjack test page</title> </head> <body> <p>Website is vulnerable to clickjacking!</p> <iframe src="http://www.target.site" width="500" height="500"></iframe> </body> </html>
Result Expected: If you can see both the text "Website is vulnerable to click jacking!" at the top of the page and your target web page successfully loaded into the frame, then your site is vulnerable and has no type of protection against Click jacking attacks. Now you can directly create a "proof of concept" to demonstrate that an attacker could exploit this vulnerability.
So if text is only displayed and the site is not successfully loaded, does that mean the site is not vulnerable ?