445 S&P 500 Companies Are Missing Both Clickjacking Defenses — 84% Have No Bounty Program

Our ninth cross-reference. No X-Frame-Options, no Content-Security-Policy frame-ancestors directive — meaning no content-security-policy header at all — leaves a page embeddable in an invisible iframe on someone else's site.

NullBlocks Research — August 2026

Clickjacking is one of the oldest tricks in the book: an attacker loads your login page, checkout flow, or admin panel inside a transparent <iframe> on their own site, overlays convincing decoy UI on top, and tricks a logged-in visitor into clicking buttons they never actually saw. The fix has existed for over a decade and takes one response header — either the legacy X-Frame-Options: DENY/SAMEORIGIN, or a Content-Security-Policy with a frame-ancestors directive (which also supersedes X-Frame-Options in every modern browser). A site only needs one of the two to be protected.

So we asked: across the whole S&P 500, how many live HTTPS hosts ship neither?

Methodology, up front

We took the latest live HTTPS response (200–399) recorded for every scanned host across the index and checked whether the response headers we already had on file (routine attack-surface scanning, no new probes) contained x-frame-options or content-security-policy. A host missing both is a confirmed clickjacking-defense gap — not a guess about configuration, the literal header set the server sent back. We then cross-referenced the affected companies against HackerOne's public bounty-scope data, the same dataset used in all eight of our previous reports.

What we found

445 of 543 S&P 500 companies (82.0%) have at least one live HTTPS host that ships neither X-Frame-Options nor a Content-Security-Policy header — 163,378 individual host findings across the index. That's the largest share of the index we've found exposed to any single exposure class in this series so far.

373 of those 445 companies (83.8%) have zero matched HackerOne bounty coverage anywhere. Same disclosure-gap shape as every one of our first eight reports, on a ninth independent exposure class — and this one is a UI-redress risk a researcher can demonstrate with a five-line HTML PoC, no tooling required.

The 15 largest affected companies by raw host count:

Note that even several companies with an active bounty program (Colgate-Palmolive, Marriott, Aon, Airbnb, PayPal, Schlumberger) still carry thousands of individually exposed hosts — a bounty program covering some in-scope assets doesn't mean every subdomain got the same header configuration. Block, Inc. tops the list at 27,913 affected hosts with zero bounty coverage on file anywhere.

Why this matters, not just as a checkbox

Missing clickjacking headers don't hand over an account directly — they open the door for a UI-redress attack chained with something else (a transfer-funds button, an OAuth consent screen, a change-password form). That's exactly why it's:

• Trivial to verify — no scanning tools, no exploit chain, just two missing response headers any researcher can check with a single curl -I.
• Trivial to fix — one line in most web server or CDN configurations (X-Frame-Options: SAMEORIGIN or a frame-ancestors 'self' CSP directive), no application code changes.
• Compounds with everything else on this list — a host with an expired TLS cert (our sixth report) or no HSTS (our eighth) and no clickjacking defense multiplies the number of independent attack paths against the same page.
• Exactly the low-effort, high-signal class bounty programs exist to absorb — and 83.8% of the affected companies have nowhere for a researcher to send it.

Nine reports, one pattern

This is the ninth independently-derived exposure class we've published from the same underlying dataset — after subdomain takeover risk, GraphQL introspection, Wayback-archived legacy pages, version-matched critical CVEs, exposed database/admin ports, expired TLS certificates, unmonitored sister domains via reverse WHOIS, and missing HSTS. Every single one has landed in the 76–98% no-bounty-coverage range, and this one affects the largest share of the index yet (82.0%, versus 61.3% for HSTS and 38.3% for expired certs). The pattern isn't which exposure class you pick — it's that most of the S&P 500 simply has no formal channel for a security researcher to report anything, no matter how it was found.

Data pulled from NullBlocks' live DomRecon scan database, cross-referenced against HackerOne's public program directory. Methodology and full company list available on request.