# Configuring frames with the X-Frame-Options header

> Set the X-Frame-Options header to control whether your pages can load in frames, and fix framed content that will not load.

Source: https://helpcenter.ruachost.com/developers/guides/configuring-frames-with-the-x-frames-options-header/

## Configuring Frames with the X-Frame-Options Header

The `X-Frame-Options` HTTP header controls whether a web page can be displayed in a frame, iframe, or object. Misconfigured headers can prevent frame content from loading.

### Common Issues

When frame content fails to load, browsers may show errors like:

**Firefox:**

```
Load denied by X-Frame-Options: "sameorigin" from "https://example.com/", site does not permit cross-origin framing from "https://example.com/test.html"
```

**Chrome:**

```
Refused to display 'https://example.com/' in a frame because it set 'X-Frame-Options' to 'sameorigin'.
```

These occur because the server sends an `X-Frame-Options` header with one of the following values:

| Value | Effect |
| --- | --- |
| `sameorigin` | Allows content only in frames from the same origin as the page. |
| `deny` | Prevents content from being displayed in a frame entirely. |

### Configuring the Header

By default, `X-Frame-Options` is often set to `sameorigin`. To allow frame content across multiple sites you control, you must **disable this header**.

Add this line to your `.htaccess` file in the directory where you want to allow remote access:

```
Header always unset X-Frame-Options
```

### Verifying the Header

Use the `curl` command to check if the header is being sent:

```
curl -I http://example.com
```

- If `X-Frame-Options` does **not appear** in the response headers, it has been successfully disabled.

### More Information

For details and best practices, visit:\
[X-Frame-Options - MDN Web Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options)