Defense for Clickjacking attack

clickjacking is an attack which uses transparent layers on browsers.
Users see normal webpages, with invisible layers (inserted by attackers).
It appears that webpages are normal, users type into forms / click buttons, but actually users type into forms / click buttons on invisible layers. Attackers will get the data users have typed into invisible layers.

X-Frame-Options Header will defend clickjacking attack.
https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet

$response->set_header('X-FRAME-OPTIONS', 'SAMEORIGIN');