How to prevent my site from being rendered in an iframe

Using Header

Newer browsers accept an HTTP header for this purpose:

X-Frame-Options

Here are the options:

• deny - framing not allowed

• sameorigin - not allowed if not of the same source

• allow-from - allows only the specified source

• allowall - (non-default) allows framing of any location.

Example in PHP:

<?php header('X-Frame-Options: deny'); ?>

JS Solution

For other browsers, the only solution is to use a JS to prevent content from remaining "framed":

if (parent.frames.length > 0) {
  top.location.replace(document.location);
}

But if JS is disabled in the frame, there is not much to do. Anyway, it's always the client who controls this.

add the following header to your page:

X-Frame-Options : DENY

You can also use SAMEORIGIN instead of DENY