The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a <frame>, <iframe> or <object> . Sites can use this to avoid clickjacking attacks, by ensuring that their content is not embedded into other sites.

You can Enable Clickjack Protection for Visualforce Pages Even When Headers Are Disabled since the Sumer 2015 Release. Releas Notes

Related Knowledge Article