[tannhaeuser]

If even Google can't get basic clickjacking protection right, I really see no hope for the Web as it is. Is there a FF plugin to block all forms of non-first-party content (including but not limited to iframes) and also to switch off "dubious" use of CSS?

[hyperdunc]

Look into uMatrix - it's a damn good plugin for this purpose. But you might need to find something else to control CSS loading.