Configuring frames with the X-Frames-options header

Configuring Frames with the X-Frame-Options Header

The X-Frame-Options HTTP header controls whether a web page can be displayed in a frame, iframe, or object. Misconfigured headers can prevent frame content from loading.

Common Issues

When frame content fails to load, browsers may show errors like:

Firefox:

Load denied by X-Frame-Options: "sameorigin" from "https://example.com/", site does not permit cross-origin framing from "https://example.com/test.html"

Chrome:

Refused to display 'https://example.com/' in a frame because it set 'X-Frame-Options' to 'sameorigin'.

These occur because the server sends an X-Frame-Options header with one of the following values:

Value	Effect
sameorigin	Allows content only in frames from the same origin as the page.
deny	Prevents content from being displayed in a frame entirely.

Configuring the Header

By default, X-Frame-Options is often set to sameorigin. To allow frame content across multiple sites you control, you must disable this header.

Add this line to your .htaccess file in the directory where you want to allow remote access:

Header always unset X-Frame-Options

Verifying the Header

Use the curl command to check if the header is being sent:

curl -I http://example.com

• If X-Frame-Options does not appear in the response headers, it has been successfully disabled.

More Information

For details and best practices, visit:
X-Frame-Options - MDN Web Docs