Apache set Content-Security-Policy

Header always set Content-Security-Policy "frame-ancestors 'self' https://www.example.com https://example.com https://first.example.com ;"