What clickjacking is
Clickjacking is an attack that turns your own page against your users. The attacker loads your page inside a transparent iframe and stacks it over their own visible interface. The victim sees the attacker's page and clicks what looks like a harmless button, but the click actually lands on your hidden page underneath. With the right alignment an attacker can make a user confirm a payment, change an account setting, or grant a permission without ever knowing your page was involved.
Why X-Frame-Options and frame-ancestors stop it
The attack only works if a browser is willing to render your page inside a frame on another site. Two headers let you control that. X-Frame-Options is the older option and accepts DENY to block all framing or SAMEORIGIN to allow framing only from your own site. The CSP frame-ancestors directive does the same job with finer control, letting you name the exact origins allowed to embed your page. When either header refuses the attacker's origin, the browser simply will not load your page in their frame and the attack falls apart.
How to add protection
The modern approach is a Content-Security-Policy header with frame-ancestors 'self', which lets only your own origin embed the page and blocks everyone else. If the page should never be framed at all, use frame-ancestors 'none'. For broad coverage on older browsers, pair it with X-Frame-Options set to SAMEORIGIN or DENY. You can build a complete policy that includes frame-ancestors with the free CSP generator and copy it straight into your server configuration.