Securing Against Clickjacking with X-Frame-Options Header

server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate /etc/nginx/ssl/example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/example.com.key;

    add_header X-Frame-Options "DENY" always;
    # Or: add_header X-Frame-Options "SAMEORIGIN" always;

    # ... other Nginx configurations
}

How it works: The `X-Frame-Options` HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a `<frame>`, `<iframe>`, `<embed>`, or `<object>`. Websites can use this to avoid clickjacking attacks by ensuring that their content is not embedded into other sites. `DENY` prevents any domain from framing the content, while `SAMEORIGIN` allows framing only by pages from the same origin.