Set X-Frame-Options and Content-Security-Policy headers