iframes can be exploited in clickjacking attacks where an attacker overlays an invisible iframe over a legitimate page to capture clicks.
Defend your own pages using the X-Frame-Options or Content-Security-Policy: frame-ancestors HTTP headers.
# HTTP headers to prevent your page being iframed
X-Frame-Options: SAMEORIGIN
# Modern CSP equivalent (more flexible)
Content-Security-Policy: frame-ancestors 'self' https://trusted.com
# Deny all framing
X-Frame-Options: DENYContent-Security-Policy frame-ancestors supersedes X-Frame-Options — use CSP for modern browsers.