Detect if my page is a clickjacking destination - php

Question

Is there any option to detect if my page is being loaded from a clickjacking page?
I mean, does not matter if the page is the origing of the clickjacking(I've setted the X-FRAME-OPTIONS header), the thing is if from a clickjacked page users are browsing to mine page.
The first solution I found is to control the HTTP-REFERER, but is a hard work because I can't control all my traffic.
Sorry for my english.

Answer 1

Unless you intend for external sites to be able to POST to yours, if you have a POST request originating from another server, it's probably click jacking:
if($_SERVER['REQUEST_METHOD'] == 'POST' && !strstr($_SERVER['HTTP_REFERER'], 'mydomain.com') {
//probably clickjacking
}
If you have pages that use GET that are susceptible to clickjacking, you can either add a check for the HTTP_REFERER on a per-page basis, or change the page to use POST (which is usually best for something which does an update).

Answer 2

One of your options is to set your website header: "X-Frames-Options" to "SAMEORIGIN"
This should prevent your website from being loaded into iframes and frames unless the originating page is in your domain.
Note that this will only work for certain browsers, for example I don't think this will work with IE7 and below and I don't think it works with chrome. This will at least reduce your attack surface a little bit.
Apache:
Header always append X-Frame-Options SAMEORIGIN
MDN - The X-Frame-Options response header
EDIT: Now that I understand better...
Perhaps you can use code similar to this:
if (window.top !== window.self) {
// do something here
}
This is one way to detect if the page is loaded into an iframe. You could set a cookie here, call a WebService here, or use window.location.href to navigate.
Here is an example of the "frame-busting" defense for click jacking:
Clickjacking Defense
-KB