Configuring Frames with the X-Frame-Options Header
The X-Frame-Options HTTP header controls whether a web page can be displayed in a frame, iframe, or object. Misconfigured headers can prevent frame content from loading.
Common Issues
When frame content fails to load, browsers may show errors like:
Firefox:
Load denied by X-Frame-Options: "sameorigin" from "https://example.com/", site does not permit cross-origin framing from "https://example.com/test.html"Chrome:
Refused to display 'https://example.com/' in a frame because it set 'X-Frame-Options' to 'sameorigin'.These occur because the server sends an X-Frame-Options header with one of the following values:
| Value | Effect |
|---|---|
sameorigin |
Allows content only in frames from the same origin as the page. |
deny |
Prevents content from being displayed in a frame entirely. |
Configuring the Header
By default, X-Frame-Options is often set to sameorigin. To allow frame content across multiple sites you control, you must disable this header.
Add this line to your .htaccess file in the directory where you want to allow remote access:
Header always unset X-Frame-OptionsVerifying the Header
Use the curl command to check if the header is being sent:
curl -I http://example.com-
If
X-Frame-Optionsdoes not appear in the response headers, it has been successfully disabled.
More Information
For details and best practices, visit:
X-Frame-Options - MDN Web Docs
