Security headers tell browsers how to protect visitors. One common header controls whether your site can be shown inside a frame on another site, which helps prevent "clickjacking".
Stop other sites framing your pages
Add to your site's .htaccess file:
<IfModule mod_headers.c>
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Content-Security-Policy "frame-ancestors 'self'"
</IfModule>
Allow one specific site to frame your pages
The old ALLOW-FROM value of X-Frame-Options isn't supported by modern browsers. Use Content-Security-Policy instead and remove X-Frame-Options:
<IfModule mod_headers.c>
Header always unset X-Frame-Options
Header always set Content-Security-Policy "frame-ancestors 'self' https://partner-site.co.uk"
</IfModule>
Other useful headers
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Check your headers at securityheaders.com. Test your site afterwards, as strict headers can block legitimate embedded content.
