Hujumchi saytning ustiga iframe qo'yadi. Foydalanuvchi o'ziga tegishni o'ylab, aslida boshqa tugmani bosadi — masalan "To'lovni tasdiqlash" yoki "Parolni o'zgartirish".

<!-- zararli.uz -->
<iframe src="https://site.uz/balance/pay" style="position:fixed;
  top:0;left:0;width:100%;height:100%;opacity:0.01;z-index:9999"></iframe>
<button style="position:fixed;top:10px;left:10px;z-index:99999">
  VIDEO YUKLAB OLISH</button>
// foydalanuvchi "YUKLAB OLISH" ni bosadi → aslida to'lov

# 1) frame-ancestors / X-Frame-Options bormi?
curl -s -D- -o /dev/null https://site.uz/ | grep -iE "x-frame-options|content-security-policy"

# 2) kodda
grep -rniE "x-frame-options|frame-ancestors" . --include=*.php --include=*.js | head

# 3) iframe bilan sinash
cat > /tmp/click.html <<'EOF'
<html><body><iframe src="https://site.uz/api/admin/settings"
  style="width:100%;height:600px;border:0"></iframe></body></html>
EOF
xdg-open /tmp/click.html   # yoki shunchaki ochib qarang

# 1) barcha sahifalarda bormi?
for P in / /login /admin /api/me /dashboard /checkout; do
  H=$(curl -s -D- -o /dev/null "https://site.uz$P" | grep -ciE "x-frame-options|frame-ancestors")
  printf "  %-14s %s\n" "$P" "$([ $H -gt 0 ] && echo '✓ himoyalangan' || echo '✗ YO\'Q')"
done

# 2) aniq sarlavhalar
curl -s -D- -o /dev/null https://site.uz/ | grep -iE "^x-frame-options|^content-security-policy"

# 3) localhost dan iframe sinash
cat > /tmp/frame.html <<'EOF'
<!DOCTYPE html><html><head><title>click test</title></head>
<body style="margin:0">
<div style="position:fixed;top:200px;left:100px;z-index:10">
  <button style="padding:20px;font-size:20px">YUKLAB OLISH</button></div>
<iframe src="https://site.uz/reset-password" style="width:100%;height:400px"></iframe>
</body></html>
EOF
python3 -m http.server 8000 --directory /tmp &
echo "  http://127.0.0.1:8000/frame.html"

# 4) DRM / to'lov sahifalari — alohida e'tibor
for P in /checkout /payment /admin/withdraw /api/admin/2fa-disable; do
  echo "$P: $(curl -s -D- -o /dev/null https://site.uz$P | grep -i x-frame-options | head -1)"
done

1. CSP — zamonaviy usul

Content-Security-Policy: frame-ancestors 'none'          // butun sayt
Content-Security-Policy: frame-ancestors 'self'         // o'z sayt ichida

2. Eski sarlavha (moslik uchun)

X-Frame-Options: DENY          // to'liq taqiq
X-Frame-Options: SAMEORIGIN     // o'z sayti ichida

3. Apache (.htaccess)

Header always set X-Frame-Options "SAMEORIGIN"
Header always set Content-Security-Policy "frame-ancestors 'self'"

4. nginx

add_header X-Frame-Options "SAMEORIGIN" always;
add_header Content-Security-Policy "frame-ancestors 'self'; default-src 'self'" always;

5. To'lov sahifalari uchun

// to'lov sahifasi faqat o'z domen ichida
frame-ancestors 'self' https://meeshar.uz

• `frame-ancestors 'none'` yoki `'self'`
• `X-Frame-Options: DENY/SAMEORIGIN` (moslik)
• Barcha route'larda (404 ham) qo'yilgan
• To'lov va admin sahifalari alohida tekshirilgan
• `ALLOW-FROM` ishlatilmadi
• iframe test sahifasi bilan sinab ko'rildi