Undos on card played.
In the Sky Blue Book (cool name, excellent publication) 4.3 states that "In all EBU events, there are no UNDOs in the play". This is the online application of Law 45C - so often stated as there "is no such thing as a unintended play" (c.f. Law 25A: Unintended call).
The more I think about this, the more I think this needs a more nuanced approach.
Law 45C has definitions of a "played card" that are very much rooted in real world bridge: eg
Declarer is deemed to have played a card from his hand if it is:
(a) held face up, touching or nearly touching the table; or
(b) maintained in such a position as to indicate that it has been played.
Neither of these apply in online bridge. Since we don't want it to be impossible for people to play cards, we have to interpret this in a way that applies to the online world. Click a card, it appears, card played.
BUT laws 48 and 49 admit the possibility of cards being exposed accidentally. Is this not what a (genuine) misclick is? 45C refers to deliberate actions, not accidental ones. A fumbling of cards, dropping one (IMHO) equates to a fumbling of the mouse, and I submit that laws 48 and 49 are the ones to apply for a (again genuine) misclick.
What does this mean? For declarer, the undo is allowed. For defender a penalty card is created. If not an honour it will be a minor penalty card and the requirement to play much less onerous than a major one , which would have to be played anyway.
Note that law 50 also allows for director discretion: "A card prematurely exposed (but not led, see Law 57) by a defender is a penalty card unless the Director designates otherwise". I can't immediately think of a situation where it would apply, though.