From d67650e38cd150ce190e5116355fcb362eb759bd Mon Sep 17 00:00:00 2001
From: wbamberg <will@bootbonnet.ca>
Date: Sun, 1 Feb 2026 22:22:03 -0800
Subject: [PATCH] Add a couple of headings in the clickjacking guide (#42981)

* Add a couple of headings in the clickjacking guide

* Review feedback

* Update files/en-us/web/security/attacks/clickjacking/index.md

Co-authored-by: Hamish Willee <hamishwillee@gmail.com>

---------

Co-authored-by: Hamish Willee <hamishwillee@gmail.com>
---
 files/en-us/web/security/attacks/clickjacking/index.md | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/files/en-us/web/security/attacks/clickjacking/index.md b/files/en-us/web/security/attacks/clickjacking/index.md
index 8c73de41adfe102..b9f53e054617d8d 100644
--- a/files/en-us/web/security/attacks/clickjacking/index.md
+++ b/files/en-us/web/security/attacks/clickjacking/index.md
@@ -50,17 +50,21 @@ If the user tries to click "Click here for a free kitten!", they will actually b
 
 ## Clickjacking defenses
 
-Clickjacking depends on the target website being embedded in the attacker's decoy site inside an `<iframe>`. The main defense is to disallow or at least control this capability.
+### Restricting embedding
+
+Clickjacking depends on the target website being embedded in the attacker's decoy site inside an `<iframe>`. The main defense is to disallow or at least restrict this capability.
 
 There are two relevant tools here:
 
-- The [`frame-ancestors` directive](/en-US/docs/Web/HTTP/Guides/CSP#clickjacking_protection) in a [content security policy](/en-US/docs/Web/HTTP/Guides/CSP)
-- The {{httpheader("X-Frame-Options")}} response header.
+- The [`frame-ancestors` directive](/en-US/docs/Web/HTTP/Guides/CSP#clickjacking_protection) in a [content security policy](/en-US/docs/Web/HTTP/Guides/CSP). With this directive, you can control exactly which other documents are allowed to embed yours.
+- The {{httpheader("X-Frame-Options")}} response header. This header is less fine-grained: it just enables you to disable embedding entirely, or allow it only for [same-origin](/en-US/docs/Web/Security/Defenses/Same-origin_policy) documents.
 
 The `frame-ancestors` directive is a replacement for `X-Frame-Options`. By setting `X-Frame-Options` as well as `frame-ancestors`, you can prevent embedding in browsers that don't support `frame-ancestors`. As [browser support for `frame-ancestors` is very good](/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-ancestors#browser_compatibility), this is not a major concern.
 
 If `frame-ancestors` and `X-Frame-Options` are both set, then browsers that support `frame-ancestors` will ignore `X-Frame-Options`.
 
+### Restricting cross-site cookies
+
 As an additional partial mitigation, sites should set the [`SameSite`](/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#samesitesamesite-value) cookie attribute for session cookies to `Lax` or `Strict`. Requests from embedded contexts such as `<iframe>` elements that are not {{glossary("Site", "same-site")}} with the top-level document will not include these cookies, and the server will therefore not treat the request as coming from a logged-in user.
 
 ## Defense summary checklist