HTTP header that controls whether a page can be framed, mitigating clickjacking on wallet popups and admin dashboards; modern CSP frame-ancestors is preferred.