Django Design Patterns and Best Practices: Industry-standard web development techniques and solutions using Python, 2nd Edition

by Arun Ravindran

It works by setting the X-Frame-Options header to SAMEORIGIN for every outgoing HttpResponse. Most modern browsers recognize the header, which means that this page should not be inside a frame in other domains.

Django setting enabled by default to prevent iframe embedding