This guide details the header X-Frame-Options, used to protect your site against clickjacking (click hijacking).

Values for the X-Frame-Options header

This header tells the browser whether to allow or not the display of your page in a <frame> or <iframe> tag.

1. "DENY" : Complete prohibition. The site cannot be loaded in any frame, even from your own site.
2. "SAMEORIGIN" : Allows display in an iframe only if the parent site has the same domain as the content.

Implement the header

Via the .htaccess file (recommended for the entire site) :

Header set X-Frame-Options "SAMEORIGIN"

Or via PHP (for a specific page) :

<?php
header('X-Frame-Options: SAMEORIGIN');
?>

The modern alternative: Content-Security-Policy (CSP)

If you need to allow a specific external site (e.g. domain.xyz) to embed your content, do not use X-Frame-Options but the following header in your .htaccess :

Header set Content-Security-Policy "frame-ancestors 'self' https://domain.xyz"

This rule allows your own site ('self') as well as domain.xyz to display you in an iframe.