by Andy Feliciotti 5 (3 reviews)

WP Anti-Clickjack

Name: WP Anti-Clickjack
Rating: 5.0 (3 reviews)
Author: Andy Feliciotti

Protect your WordPress site from clickjacking with X-Frame-Options and CSP frame-ancestors headers plus a frame breaking script.

WP Anti-Clickjack ranks #3,615 among WordPress.org plugins with 3,000+ active installations, is #307 of 5,058 in the Security category, a 5/5 rating from 3 reviews, and was last updated Oct 13, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1

v1.9.0 Current Version v1.9.0

Updated 2 weeks ago Last Update on 13 Oct, 2026

Refreshed 2 days ago Last Refreshed on

#307 of 5,058 in Security Top 5% by installs Downloads -30.7% this week Actively maintained

View on WordPress.org

Rank

#3,615

— No change

Active Installs

3K+

-30.1%

KW Avg Position

1.7

— No change

Downloads

47.3K

+24 today

Support Resolved

— No change

Rating

100%

Review 5 out of 5

5 (3 reviews)

Next Milestone 4K

Total Progress 99.7%

3K+ 4K+

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 3 more installs to reach 4K+

Rank Changes

Current #3,615

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

5.0

3 reviews

Overall 100%

3 (100%)

0 (0%)

Security History

Source: WPVulnerability

No known vulnerabilities on record for WP Anti-Clickjack. Checked 1 month ago.

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 1.9.0
Last Updated: Oct 13, 2026
Requires WP: 5.0+
Tested Up To: 7.1
PHP Version: 7.0 or higher
Author: Andy Feliciotti

Support & Rating

Rating: ★ ★ ★ ★ ★ 5
Reviews: 3
Support Threads: 0
Resolved: 0%

Keywords

Browser Frame Breaking Script anti click jacking clickjacking security

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

Akismet Anti-spam: Spam Protection

5M+ installs

Wordfence Security – Firewall, Malware Scan, and Login Security

5M+ installs

#11

Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)

Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention

View all Security-and-spam-protection plugins

TL;DR

AI summary of the plugin's readme

This plugin is for WordPress site owners who want protection against clickjacking attacks. It adds the X-Frame-Options header and OWASP's legacy frame-breaking script to prevent other sites from embedding the site in an iframe.

Adds X-Frame-Options SAMEORIGIN header
OWASP legacy frame breaking script
Compatible with Elementor, Divi, WPBakery, Bricks, Breakdance, Oxygen
Filters to disable anti-clickjacking measures
Easy to install and configure
Regularly updated and tested

Frequently Asked Questions

Common questions about WP Anti-Clickjack

No, WP Anti-Clickjack is designed to have minimal impact on your site's performance. The anti-clickjacking measures are applied efficiently without causing any significant overhead.

Yes, WP Anti-Clickjack is compatible with popular page builders and editors such as Elementor, Divi, WPBakery, Thrive Architect, and more. If you encounter any compatibility issues, please contact me for assistance.

Add its address under Settings > Anti-Clickjack, like https://partner.example (or https://*.example.com for every subdomain). Developers can use the wp_anti_clickjack_allowed_origins filter shown under Additional Details. The site is added to the frame-ancestors policy and the frame breaking script allows it too.

Go to Tools > Site Health. The plugin's check loads your homepage the way a visitor would and tells you if the headers are missing (often a page cache or CDN serving pages without them) or if more than one framing policy is sent. Click "Check from outside" there or under Settings > Anti-Clickjack to have ClickJack Test load your homepage from the internet, through any CDN or proxy, and show what it sees.

Yes, the plugin provides filters that allow you to disable the clickjacking JavaScript and the X-Frame-Options header when needed. You can use these filters in your theme's functions.php file to fine-tune the plugin's behavior.