I was looking at a lecture of clickjacking and when I tried to create an iframe to go to website, I noticed that websites with no https are able vulnerable to clickjacking. Is there another way to stop clickjacking without SSL or do you need to use something else?
There is an anti ClickJacking HTTP header you can add to your responses.
X-Frame-Options: DENY X-Frame-Options: SAMEORIGIN X-Frame-Options: ALLOW-FROM https://example.com/
Deny will stop the content loading into a frame, iframe or object, Same Origin will allow loading into pages on the same domain, 'Allow From' allows you to specify URIs that may frame your content.
The browser implements support for this, so there is a reliance on the user using a browser that complies with the header, though major browsers have supported this for a while- support is in place for IE11, Edge14 and Chrome 49.
You should configure your webserver to add this HTTP header to responses
You can also use frame ancestors if you are using a Content Security Policy.
A website prevents clickjacking by preventing untrusted origins from embedding the site in a frame.
The established and reliable way to achieve this is to send an
X-Frame-Options header. If you have no intention of having you page embedded in a frame of any origin, you can set it to
Other options are
SAMEORIGIN for access from the same domain and
ALLOW-FROM to specify permitted domains.
The more modern (but not as widely supported) way to prevent clickjacking is sending a CSP header with the
frame-ancestors directive. Setting it to
none has roughly the same effect as
Content-Security-Policy: frame-ancestors 'none';
You can find all common anti-clckjacking techniques in OWASP's Clickjacking Defense Cheat Sheet.