I have some of my contents hosted on github . As we know github allows us to host pages on their server. And they have clickjacking protection disabled. The only way I could find to avoid my website getting loaded in iframe is by adding
<meta http-equiv="X-Frame-Options" content="SAMEORIGIN">
But this can be easily bypassed by html 5's new sandbox
<iframe sandbox="allow-modals allow-scripts allow-forms allow-popups allow-same-origin" src="http://thewebsite.com" width=600 height=400>
</iframe>
Is there any other way to fix the clickjacking issue so as not to allow anyone to iframe my website?
I caot make server side fix as the contents are hosted on github. Or is it possible ?