Never allow admin panel to be inside a frame, use both modern and old headers. Also set no content sniffing
Attach a file by drag & drop or click to upload
