if ($http_referer !~ "https://example\.com/"){
    add_header X-Frame-Options SAMEORIGIN;
}