Refusing to be framed

One header closes it

Clickjacking is stopped by telling the browser who may frame you:

Tip: Send Content-Security-Policy: frame-ancestors 'none' (or a trusted list), and X-Frame-Options: DENY for older browsers, on every page that performs sensitive actions. Back it up with SameSite cookies so a framed page doesn't carry the victim's session in the first place.