Quick snippet on defending against clickjacking / UI Redress attacks - https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet

don't allow iframing.php

<?PHP
//The response header will have the x-frame-options header that tells browsers that support it to not allow this page to be iframed.  
header('X-Frame-Options: DENY'); 
?>
<!-- Set the body's css to not show, and have the javascript remove this code if we are the top page. -->
<style id="antiClickjack">
  body{display:none !important;}
</style>
<script type="text/javascript">
   if (self === top) {
       var antiClickjack = document.getElementById("antiClickjack");
       antiClickjack.parentNode.removeChild(antiClickjack);
   } else {
       top.location = self.location;
   }
</script>