Clickjacking & UI Occlusion

Clickjacking & UI Occlusion ProtectionClickjacking & UI Occlusion Protection

Open Publisher includes a passive, lightweight security system that protects users from clickjacking and UI redressing scams – attacks where a malicious website frames Open Publisher inside a hidden or transparent layer and overlays it with deceptive UI, tricking users into interacting with the attacker’s content while believing they are using Open Publisher normally.

How It WorksDefault Suspicious Activity Detected Dialog

Using the IntersectionObserver v2 (occlusion tracking) API, Open Publisher continuously monitors whether the workspace is being covered by unauthorised content from another frame or website. If an occlusion is detected, a clear in-app warning dialog immediately alerts the user that they may be interacting with a scam.

Legacy / Fallback of Default Suspicious Activity Detected Dialog

Key Behaviours

  • Key Behaviours

    No false positives – The system tracks physical pixel occlusion, not domain blacklists, so it never incorrectly triggers against legitimate CMS integrations or creative suite embeds.

  • No forced redirects – The protection does not force browser redirects, avoiding any risk of triggering Google Safe Browsing flags.

  • Graceful fallback – On older browsers that do not support occlusion tracking, the system fails silently via a try-catch – no errors, no broken functionality, just no protection on unsupported browsers.