if ($http_referer !~ "^https://example\.com/"){
    add_header X-Frame-Options SAMEORIGIN;
}