Just add obfuscated java script code that checks the host and errors out if its not your domain. Can still be bypassed, just will take some reverse engineering.

Ive added JSFuck code for this specifically on a few occasions