iframe Security Clickjacking and X-Frame-Options

Clickjacking (UI redressing) embeds a target site in a transparent iframe over a decoy page. The user thinks they're clicking the decoy but actually clicks the hidden, authenticated page below — executing actions on the target site without knowledge.

The attacker loads victim.com in a transparent iframe positioned over a "Click to win!" button. When the user clicks, they actually click victim.com's "Delete Account" button — authenticated as themselves in victim.com's session cookie. No phishing required.