X-Frame-Options: DENY is obsolete. Use Content-Security-Policy instead.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...