[alphapapa]

NoScript->Options->Embeddings->Additional restrictions for untrusted sites->Forbid <IFRAME>

Just turned that option on, myself. I might have had it on years ago--can't remember for sure--but now that I know it's being abused, I'll definitely leave it on. IFRAMEs are generally poor practice, anyway.

[jakobdabo]

Also, pay attention to these settings in about:config page:

accessibility.blockautorefresh

noscript.forbidBGRefresh

noscript.forbidMetaRefresh

Additionally, you can cherry-pick options (or just use it all) from this repository at https://github.com/pyllyukko/user.js for more privacy.

[alphapapa]

Thanks! I'll look into those.