# ClickJacking vulnerability

**URL:** <https://community.hubspot.com/t/clickjacking-vulnerability/135568>\
**Category:** CMS Development\
**Tags:** professional\
**Created:** [July 2, 2025, 2:23pm UTC](https://community.hubspot.com/t/clickjacking-vulnerability/135568 "2025-07-02T14:23:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ALombardo](https://avatars.discourse-cdn.com/v4/letter/a/ac91a4/32.png) [@ALombardo](https://community.hubspot.com/u/ALombardo)\
**Post date:** [July 2, 2025, 2:23pm UTC](https://community.hubspot.com/t/clickjacking-vulnerability/135568/1 "2025-07-02T14:23:57Z")

</div>

Dear Sir,

From internal testing, we found a ClickJacking web security vulnerability in pages, which is located on Hubspot.

We know that it is possible to mitigate this vulnerability by going to modify the web server.  
With APACHE, you need to modify the configuration file by adding X-Frame-Options “DENY” or “SAMEORIGIN.”

I tried to contact Hubspot support who told me that they are not experienced developers and we are not able to modify the code or identify the vulnerabilities and to try to contact the developer community.

Could you please help us figure out how to make the changes so

that we can fix the vulnerability found?

Thank you very much  
Have a nice day  
Anna

---

<div class="post-metadata">

**Author:** ![Victor\_Becerra](https://avatars.discourse-cdn.com/v4/letter/v/87869e/32.png) [@Victor\_Becerra](https://community.hubspot.com/u/Victor_Becerra)\
**Post date:** [July 2, 2025, 7:36pm UTC](https://community.hubspot.com/t/clickjacking-vulnerability/135568/2 "2025-07-02T19:36:11Z")

</div>

Hi @ALombardo ,

Thank you for reaching out to the Community!

I wanted to invite our subject matter experts to this conversation. Hi @Josh , @IsaacTakushi [@matt\_scott](https://community.hubspot.com/t5/user/viewprofilepage/user-id/64119) - Do you have any advice for @ALombardo ?

Thank you!

Best,

---

<div class="post-metadata">

**Author:** ![GiantFocal](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/giantfocal/32/41969_2.png) [@GiantFocal](https://community.hubspot.com/u/GiantFocal)\
**Post date:** [July 3, 2025, 2:44am UTC](https://community.hubspot.com/t/clickjacking-vulnerability/135568/3 "2025-07-03T02:44:03Z")

</div>

Hi @ALombardo,

HubSpot offers the option to add X-Frame-Options, which can be found under your Domain Settings.

Simply click **Action \> Update domain security settings** :

 ![GiantFocal_0-1751510364954.png](https://d2qpr2jzcazej7.cloudfront.net/original/3X/2/a/2a5db3cddf24f67efc115a4ce5076df6f3eaea8b.png)

Under the **Security headers** tab, you can find the option:

 ![GiantFocal_2-1751510610349.png](https://d2qpr2jzcazej7.cloudfront.net/original/2X/c/c4c34c814f9649cb7fd0f003509a7abbcde1bab7.png)