Clickjacking attack allows to perform an action on victim site on visitor’s behalf.

All modern browsers support the X-Frame-Options header.

The header allows or disallows rendering of the document when inside an iframe.

It may have two possible values:

SAMEORIGIN
The document will be rendered (shown) in an frame only if the frame and it’s parent have the same origin.
DENY
The document may not be rendered inside a frame.
Browsers ignore the header if speicified in the META tag. So the following META will be ignored: