Clickjacking

Both X-Frame-Options and Content-Security-Policy response headers define whether or not a browser should be allowed to embed or render a page in an <iframe> element. For example, setting X-Frame-Options: deny will prevent browsers from rendering your web application in an <iframe> element.

HTTP Headers

Nginx

add_header X-Frame-Options "sameorigin" always;

Apache

header always set X-Frame-Options "sameorigin"

Content Security Policy

Content-Security-Policy: frame-src https://www.uauth.io