Click-to-Play is a feature built into Google Chrome, Mozilla Firefox and Opera. It blocks plugin activity by default, replacing the plugin content on the page with a blank box. Users who wish to view the blocked content need only click the boxes to enable the Flash or Java content inside of them. Internet Explorer 10 uses a Microsoft-provided whitelist of websites that are allowed to play Flash content by default. A far safer approach with Java is simply to unplug it from the browser until and unless you need it.”]
Source: https://krebsonsecurity.com/2013/03/help-keep-threats-at-bay-with-click-to-play/