Placement of the "X-Frame-Options" header

In order to protect against clickjacking it is possible to add an X-Frame-Options header to the server hosting your site.

For PHP pages, a set header in PHP must be added, as this is run in FPM, just like when disabling HSTS, for example: https://faq.infomaniak.com/2133