The embedding is more sophisticated than just an iframe or object tag. Generally they'll proxy the target site to their own origin and strip headers.
You'd have to move the domain check in syntax and placement I guess, in an annoying game of cat and mouse... but it'd be something I suppose? Probably not worth it if it's not a large enough return.