Preventing other sites from embedding Drupal page
The technique that you want to employ is called framebusting (or framekilling).

The Frameprevention does this.  However, I typically do this manually, as I want it to happen as soon as possible, or I need to do it a certain way to pass an automated test.

Typically, I will edit html.tpl.php to add a no-js class onto the &lt;html&gt; tag, then then add this code bit directly after the opening &lt;head&gt;:

&lt;head&lt;?php print $rdf-&gt;profile; ?&gt;&gt;
  &lt;script&gt;
    // http://www.456bereastreet.com/archive/201209/tell_css_that_javascript_is_available_asap/ 
    document.documentElement.className = document.documentElement.className.replace(/(\s|^)no-js(\s|$)/, '$1js$2');
  &lt;/script&gt;
  &lt;?php // bypass render array so this is guaranteed to be very first thing ?&gt;
  &lt;style&gt;html.js { display:none }&lt;/style&gt; 
  &lt;script&gt; 
    if (self == top) { 
      document.documentElement.style.display = 'block'; 
    } else { 
      top.location = self.location;
    }
  &lt;/script&gt;


This does force users to have Javascript enabled in their browsers, which is a common problem with framebusting.  I cannot find the exact reference for the technique above, but I think it came from OWASP.  

You can also implement X-Frame-Options:

function MYTHEME_html_head_alter(&amp;$head_elements) {
  $head_elements['mytheme_x_frame_options'] = array(
    '#type' =&gt; 'html_tag',
    '#tag' =&gt; 'meta',
    '#attributes' =&gt; array(
      'name' =&gt; 'X-Frame-Options',
      'content' =&gt; 'DENY',
    ),
  );

  $head_elements['mytheme_x_frame_options']['#attached']['drupal_add_http_header'][] =
    array('X-Frame-Options', $head_elements['mytheme_x_frame_options']['#attributes']['content']);
}


Keep in mind that you may need additional logic to account for legitimate &lt;iframe&gt; elements in your site.  Some ctools modals come to mind, as well as some WYSIWYG situations.