For my site I see that among response headers there is
X-Frame-Options: SAMEORIGIN. Still I can preview my site in iframe of some different site, for instance here. But I expected not to. I assume that this is back-end work to add some more setting that would prevent the site from rendering in iframe? I thought that if it returns the above header the security functionality preventing showing site in iframe is already in place. Isn't it?
UPDATE: It's my fault I didn't specify that this header is returned for each xhr but there is no such header for static resources (html, js, css, images). Might that be a reason?
UPDATE2: I've asked BE guys to provide the header for static resources too. After implementation I'll share whether it helps or not.