1

This is the javacript code that I use to prevent clickjacking in my current project.

<style id="antiClickjack">body{display:none !important;}</style>

<script type="text/javascript">
   if (self === top) {
       var antiClickjack = document.getElementById("antiClickjack");
       antiClickjack.parentNode.removeChild(antiClickjack);
   } else {
       top.location = self.location;
   }
</script>

Does this code affect google ranking? I also implement the X-Frame-Options Header for the site.

4
  • Have you tested this code? The self === top does not look right. Maybe self == top? Can you give us the references you used for the framekiller code and X-Frame-Options? In theory, X-Frame-Options should be enough since all the major browsers recognize it and it became a standard in 2013. This is also assuming users can log in and do stuff. Otherwise, I do not think you need it. Not sure how Google would react to your code specifically. However, I did not find any issues elsewhere.
    – closetnoc
    Commented Mar 2, 2015 at 4:58
  • Here is the reference. Under the section Best-for-now Legacy Browser Frame Breaking Script owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet
    – Pinoy2015
    Commented Mar 2, 2015 at 8:16
  • What is intriguing me is the <style id="antiClickjack">body{display:none !important;}</style> becuase body is not displayed by default. It is displayed by javascript. How can google crawl it?
    – Pinoy2015
    Commented Mar 2, 2015 at 8:19
  • If you use this technique does the page show up fine when you use "Fetch and Render as Google" in Google Search Console? I'd think that the page would show up fine because Google can now use both the CSS and the JavaScript in the page. If it shows up using that tool, I don't think there will be any problem with it. Commented Oct 14, 2016 at 9:13

1 Answer 1

1

In this case you may encounter issues as Google has very strict policies around hiding anything on the page and hiding the whole page would more than likely throw off a very big alarm bell. From what I can see there is strictly no need to hide all the page contents before trying to break the frame, just break it inherently and if it doesn't break out then show an error message in the page at the top of the page above the fold and push everything else below the fold. Shouldn't trigger any Google issues.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.