if ($http_referer !~ "^https://example\.com"){
    add_header X-Frame-Options SAMEORIGIN;
}