X-Frame-Options or CSP frame-ancestors is set

Clickjacking embeds your app inside an attacker-controlled <iframe>, then overlays a transparent UI that tricks users into clicking buttons they can't see — authorizing transactions, enabling permissions, or deleting accounts on your behalf. The attack requires zero user credentials and is invisible to the victim. Without framing protection, any page on your site is a potential weapon: login buttons, payment confirmations, settings toggles. CAPEC-103 documents the attack pattern in detail. OWASP A05 identifies missing framing controls as a security misconfiguration. X-Frame-Options: DENY is a single-line fix that eliminates the entire attack surface.

Add either X-Frame-Options or the CSP frame-ancestors directive. frame-ancestors is preferred in modern configs because it's more expressive and part of CSP Level 2.

// next.config.js — choose one approach
headers: [
  // Option A: legacy X-Frame-Options
  { key: 'X-Frame-Options', value: 'DENY' },
  // Option B: CSP frame-ancestors (more flexible)
  { key: 'Content-Security-Policy', value: "frame-ancestors 'none'" }
]

Use DENY / 'none' if your site never needs to appear in an iframe. Use SAMEORIGIN / 'self' if you embed your own pages. Do not use ALLOW-FROM — it is deprecated and ignored by modern browsers.