{"id":1799,"date":"2026-08-25T11:15:16","date_gmt":"2026-08-25T11:15:16","guid":{"rendered":"http:\/\/acr.floydcraft.co.uk\/openpublisher\/?post_type=knowledgebase&p=1799"},"modified":"2026-08-25T17:30:27","modified_gmt":"2026-08-25T17:30:27","slug":"clickjacking-ui-occlusion-protection","status":"publish","type":"knowledgebase","link":"http:\/\/acr.floydcraft.co.uk\/openpublisher\/db\/security-privacy\/clickjacking-ui-occlusion-protection\/","title":{"rendered":"Clickjacking & UI Occlusion"},"content":{"rendered":"
\n

Clickjacking & UI Occlusion Protection<\/span>\"Clickjacking<\/h2>\n

Open Publisher includes a passive, lightweight security system that protects users from clickjacking<\/strong> and UI redressing scams<\/strong> – attacks where a malicious website frames Open Publisher inside a hidden or transparent layer and overlays it with deceptive UI, tricking users into interacting with the attacker’s content while believing they are using Open Publisher normally.<\/p>\n

How It Works<\/span>\"Default<\/h3>\n

Using the IntersectionObserver v2<\/strong> (occlusion tracking) API, Open Publisher continuously monitors whether the workspace is being covered by unauthorised content from another frame or website. If an occlusion is detected, a clear in-app warning dialog immediately alerts the user that they may be interacting with a scam.<\/p>\n

<\/h3>\n

\"Legacy<\/h3>\n

Key Behaviours<\/span><\/h3>\n
    \n
  • \n

    \"Key<\/h3>\n

    No false positives – <\/strong>The system tracks physical pixel occlusion, not domain blacklists, so it never incorrectly triggers against legitimate CMS integrations or creative suite embeds.<\/span><\/p>\n<\/li>\n

  • \n

    No forced redirects –<\/strong> The protection does not force browser redirects, avoiding any risk of triggering Google Safe Browsing flags.<\/span><\/p>\n<\/li>\n

  • \n

    Graceful fallback –<\/strong> On older browsers that do not support occlusion tracking, the system fails silently via a try-catch<\/span> – no errors, no broken functionality, just no protection on unsupported browsers.<\/span><\/p>\n<\/li>\n<\/ul>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

    Clickjacking & UI Occlusion Protection Open Publisher includes a passive, lightweight security system that protects users from clickjacking and UI redressing scams – attacks where a malicious website frames Open Publisher inside a hidden or transparent layer and overlays it with deceptive UI, tricking users into interacting with the attacker’s content while believing they are […]<\/p>\n","protected":false},"author":1,"featured_media":1815,"comment_status":"open","ping_status":"open","template":"","knowledgebase_cat":[22],"class_list":["post-1799","knowledgebase","type-knowledgebase","status-publish","has-post-thumbnail","hentry","knowledgebase_cat-security-privacy"],"_links":{"self":[{"href":"http:\/\/acr.floydcraft.co.uk\/openpublisher\/wp-json\/wp\/v2\/knowledgebase\/1799","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/acr.floydcraft.co.uk\/openpublisher\/wp-json\/wp\/v2\/knowledgebase"}],"about":[{"href":"http:\/\/acr.floydcraft.co.uk\/openpublisher\/wp-json\/wp\/v2\/types\/knowledgebase"}],"author":[{"embeddable":true,"href":"http:\/\/acr.floydcraft.co.uk\/openpublisher\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/acr.floydcraft.co.uk\/openpublisher\/wp-json\/wp\/v2\/comments?post=1799"}],"version-history":[{"count":18,"href":"http:\/\/acr.floydcraft.co.uk\/openpublisher\/wp-json\/wp\/v2\/knowledgebase\/1799\/revisions"}],"predecessor-version":[{"id":1825,"href":"http:\/\/acr.floydcraft.co.uk\/openpublisher\/wp-json\/wp\/v2\/knowledgebase\/1799\/revisions\/1825"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/acr.floydcraft.co.uk\/openpublisher\/wp-json\/wp\/v2\/media\/1815"}],"wp:attachment":[{"href":"http:\/\/acr.floydcraft.co.uk\/openpublisher\/wp-json\/wp\/v2\/media?parent=1799"}],"wp:term":[{"taxonomy":"knowledgebase_cat","embeddable":true,"href":"http:\/\/acr.floydcraft.co.uk\/openpublisher\/wp-json\/wp\/v2\/knowledgebase_cat?post=1799"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}