The only way to prevent XFS attacks is to completely prevent your site from being loaded into frames – the same as with clickjacking attacks. Since XFS is specific to very old browsers, modern prevention methods such as X-Frame-Options and Content-Security-Policy are not supported. The only way is to use framebusting with legacy JavaScript code specific to the browser versions you want to protect.
Find out more about methods used to protect against clickjacking.