Clickjacking protection (frame-ancestors / X-Frame-Options)
Tell browsers who is allowed to embed your pages in an iframe. Use CSP frame-ancestors. X-Frame-Options is the legacy fallback.
OWASP — Clickjacking Defense Cheat Sheet