Add a couple of headings in the clickjacking guide

files/en-us/web/security/attacks/clickjacking/index.md

@@ -50,17 +50,21 @@ If the user tries to click "Click here for a free kitten!", they will actually b
 
 ## Clickjacking defenses
 
-Clickjacking depends on the target website being embedded in the attacker's decoy site inside an `<iframe>`. The main defense is to disallow or at least control this capability.
+### Restricting embedding
+
+Clickjacking depends on the target website being embedded in the attacker's decoy site inside an `<iframe>`. The main defense is to disallow or at least restrict this capability.
 
 There are two relevant tools here:
 
-- The [`frame-ancestors` directive](/en-US/docs/Web/HTTP/Guides/CSP#clickjacking_protection) in a [content security policy](/en-US/docs/Web/HTTP/Guides/CSP)
-- The {{httpheader("X-Frame-Options")}} response header.
+- The [`frame-ancestors` directive](/en-US/docs/Web/HTTP/Guides/CSP#clickjacking_protection) in a [content security policy](/en-US/docs/Web/HTTP/Guides/CSP). With this directive, you can control exactly which other documents are allowed to embed yours.
+- The {{httpheader("X-Frame-Options")}} response header. This header is less fine-grained: it just enables you to disable embedding entirely, or allow it only for [same-origin](/en-US/docs/Web/Security/Defenses/Same-origin_policy) documents.
 
 The `frame-ancestors` directive is a replacement for `X-Frame-Options`. By setting `X-Frame-Options` as well as `frame-ancestors`, you can prevent embedding in browsers that don't support `frame-ancestors`. As [browser support for `frame-ancestors` is very good](/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-ancestors#browser_compatibility), this is not a major concern.
 
 If `frame-ancestors` and `X-Frame-Options` are both set, then browsers that support `frame-ancestors` will ignore `X-Frame-Options`.
 
+### Restricting cross-site cookies
+
 As an additional partial mitigation, sites should set the [`SameSite`](/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#samesitesamesite-value) cookie attribute for session cookies to `Lax` or `Strict`. Requests from embedded contexts such as `<iframe>` elements that are not {{glossary("Site", "same-site")}} with the top-level document will not include these cookies, and the server will therefore not treat the request as coming from a logged-in user.
 
 ## Defense summary checklist