Frame policy names who may embed your page
Clickjacking deceives a user about which interface receives an action. A hostile parent can place a framed application behind a misleading visual layer so that a click reaches a real control in that application. The parent need not read the child’s DOM for the user to interact with it. Same-origin read restrictions therefore do not replace a decision about whether the application may be embedded at all. ...