if ($http_referer !~ "^https://example.com/"){
    add_header X-Frame-Options SAMEORIGIN;
}