X-Frame-Options vs CSP frame-ancestors: protecting against clickjacking (with a passive check)

Clickjacking protection in 2026: X-Frame-Options, CSP frame-ancestors, what breaks iframes and how to detect exposure passively.