Preventing other sites from embedding Drupal page How do I prevent other sites from embedding a page from my Drupal site using an iframe? Ideally, I'd like the parent window to redirect to my website if this happens, or alternatively redirect the iframe to an error page.

Any modules/hacks/code/tips?

Thanks
The technique that you want to employ is called framebusting (or framekilling).

The Frameprevention does this.  However, I typically do this manually, as I want it to happen as soon as possible, or I need to do it a certain way to pass an automated test.

Typically, I will edit html.tpl.php to add a no-js class onto the &lt;html&gt; tag, then then add this code bit directly after the opening &lt;head&gt;:

&lt;head&lt;?php print $rdf-&gt;profile; ?&gt;&gt;
  &lt;script&gt;
    // http://www.456bereastreet.com/archive/201209/tell_css_that_javascript_is_available_asap/ 
    document.documentElement.className = document.documentElement.className.replace(/(\s|^)no-js(\s|$)/, '$1js$2');
  &lt;/script&gt;
  &lt;?php // bypass render array so this is guaranteed to be very first thing ?&gt;
  &lt;style&gt;html.js { display:none }&lt;/style&gt; 
  &lt;script&gt; 
    if (self == top) { 
      document.documentElement.style.display = 'block'; 
    } else { 
      top.location = self.location;
    }
  &lt;/script&gt;


This does force users to have Javascript enabled in their browsers, which is a common problem with framebusting.  I cannot find the exact reference for the technique above, but I think it came from OWASP.  

You can also implement X-Frame-Options:

function MYTHEME_html_head_alter(&amp;$head_elements) {
  $head_elements['mytheme_x_frame_options'] = array(
    '#type' =&gt; 'html_tag',
    '#tag' =&gt; 'meta',
    '#attributes' =&gt; array(
      'name' =&gt; 'X-Frame-Options',
      'content' =&gt; 'DENY',
    ),
  );

  $head_elements['mytheme_x_frame_options']['#attached']['drupal_add_http_header'][] =
    array('X-Frame-Options', $head_elements['mytheme_x_frame_options']['#attributes']['content']);
}


Keep in mind that you may need additional logic to account for legitimate &lt;iframe&gt; elements in your site.  Some ctools modals come to mind, as well as some WYSIWYG situations.