http{ ... map $http_referer $frame_options { "~webvisor.com" "ALLOW-FROM http://webvisor.com" ; default "SAMEORIGIN" ; } add_header X-Frame-Options $frame_options ; ... }