Merge pull request #491 from pi-hole/dont-frame-me

Make sure web interface can't be loaded into a frame

advanced/lighttpd.conf

@@ -46,7 +46,10 @@ include_shell "/usr/share/lighttpd/include-conf-enabled.pl"
 # If the URL starts with /admin, it is the Web interface
 $HTTP["url"] =~ "^/admin/" {
 	# Create a response header for debugging using curl -I
-	setenv.add-response-header = ( "X-Pi-hole" => "The Pi-hole Web interface is working!" )
+    setenv.add-response-header = (
+        "X-Pi-hole" => "The Pi-hole Web interface is working!",
+        "X-Frame-Options" => "DENY"
+    )
 }
 
 # If the URL does not start with /admin, then it is a query for an ad domain