One Small Tool That Answers One Question

Not every tool needs to be a platform. Some of the best ones I’ve ever written did exactly one thing, answered exactly one question, and then got out of the way.

This is one of those.

Back in my AppSec days, I kept running into the same question across a pile of sites: are we actually protected against clickjacking? For the uninitiated, clickjacking is the trick where a very bad person loads your page inside an invisible frame on their page and tricks your users into clicking things they never meant to click — a transfer button, a “delete account,” a permission grant. The defense is old and boring: set the right headers so browsers refuse to frame you.

Two headers do the work. X-Frame-Options is the classic. Content-Security-Policy with a frame-ancestors directive is the modern, more flexible one. If you’ve got them set correctly, you’re in good shape. If you don’t, you’re one clever overlay away from a bad day.

So the only real question is: do we have them, and are they right?

That sounds easy until you’re staring at fifty hostnames and “just check the headers” turns into an afternoon of curl and squinting.

So I wrote clickjack-headers — a utility script that fetches the X-Frame-Options and Content-Security-Policy frame-ancestors headers so you can see, at a glance, who’s covered and who isn’t.

That’s it. That’s the whole tool. It doesn’t file tickets, it doesn’t grade you on a curve, it doesn’t try to become your next dashboard. It fetches the two headers that matter and hands them back.

I’m putting it here for the same reason I keep it around: small tools that answer one question well are worth more than big tools that answer none. Point it at your hosts, find the ones missing their frame protections, and go fix them.

Then move on to the next question.