Most of the examples I have read start with a malicious website. Lets say I am creating a website without malicious intent. When does the website become vulnerable to clickjacking? Can this occur without a XSS vulnerability or without my server being compromised? If so, how?
By default, any new website is probably vulnerable to Clickjacking, depending on the webserver defaults.
Disallow embedding: All iframes etc. will be blank, or contain a browser specific error page.
Content-Security-Policy: frame-ancestors 'none'
Allow embedding of own content only:
Content-Security-Policy: frame-ancestors 'self'
Allow specific origins to embed this content :
Content-Security-Policy: frame-ancestors www.example.com www.wikipedia.org
X-Frame-Options: ALLOW-FROM www.example.com www.wikipedia.org
Most examples start with a malicious website, because an attacker will require this malicious website for his attack on your vulnerable website: He can simply create his own evil.com website, containing an iframe of your victim.org.
As long as victim.org does not prevent the attacker from doing so, victim.org will remain vulnerable to Clickjacking.
Most of the examples I have read start with a malicious website.
In a clickjacking attack, a malicious website tricks the user to click on something on the target website. The target website is the one vulnerable to clickjacking.
Lets say I am creating a website without malicious intent. When does the website become vulnerable to clickjacking?
It has to have authentication. Clickjacking is tricking someone else to click on something. The point is that the victim is logged in to the target website. The action performed on the click is only available for authorized users, otherwise the attacker could just go to the site and click it himself.
It has to have a click target that performs an impactful action at once. The victim can be tricked to click once or twice, but more complex user interaction is hard to perform.
The most common form of clickjacking works by rendering the target site in an iframe, which some HTTP headers can prevent. However, clickjacking can also be performed by quickly switching windows or sites. So preventing your site from being loaded in an iframe does not necessarily block all clickjacking attacks.
Can this occur without a XSS vulnerability or without my server being compromised? If so, how?
Yes. Your site is loaded in a transparent iframe in front of a malicious site. The malicious site tricks the user to click somewhere ("click here to view cute cat pictures") and unknowingly the user clicks on the target site.
Actual clickjacking attacks are rare, except on high-profile sites where everybody is logged in all the time and there are straightforward click targets. So Facebook likes and Twitter retweets are common targets for clickjacking attacks.