How to enable a site to be in an iframe?

Question

How can I enable a Drupal site to be in an iframe and place it in basic html page.

If I try this:

<iframe src="drupal-site.com"></iframe>

then it doesn't show any result.

Any suggestions?

Answer 1

Since Drupal 7.50, core is now protected against clickjacking by default (X-Frame-Options: SAMEORIGIN).

So by default, your Drupal site can only be embedded into a site on the same domain.

To change those settings, assuming of course you understand the associated risks, follow the advice in the change record:

1. If you are using a module such as Security Kit that already writes the X-Frame-Options header on its own, that setting will be automatically respected (pending the patch at #2661644: Integrate with Drupal core clickjacking defense) and Drupal core will not overwrite it. The Security Kit module provides an administrative interface for setting this header, so it's a good choice if you need to override the default Drupal core behavior and aren't sure exactly how to do it.

2. Alternatively, set the 'x_frame_options' variable via any standard method, for example in settings.php:

   // Turn off the X-Frame-Options header entirely, to restore the previous
   // behavior of allowing the site to be embedded in a frame on another site.
   $conf['x_frame_options'] = '';
   

   or

   // Set the "DENY" option to prevent the site from ever being embedded in a
   // frame at all, even on this site itself.
   $conf['x_frame_options'] = 'DENY';
   

   See https://developer.mozilla.org/docs/Web/HTTP/Headers/X-Frame-Options for more information on the various options this header can take.

   Removing the header (as shown in the first example code snippet above) should not be done lightly, or else your Drupal site could be embedded on other sites and then the user tricked into doing actions they don't want.

3. If you want to remove the X-Frame-Options header in hook_page_alter() or theme preprocess functions that run later you can remove the header like this (requires PHP >= 5.3):

   header_remove('X-Frame-Options');
   

Answer 2

When on Drupal 8, you have the https://www.drupal.org/project/allow_iframed_site module perfectly doing the job. The module has an easy setup page for limiting iframing by path.

Drupal 8+ has a feature built into core that stops the site from being rendered within an iframe, there are good reasons for this - https://www.drupal.org/node/2514136 But sometimes you want your site in an iframe, so that's what this module does.

Answer 3

You just need to write:

$conf['x_frame_options'] = '';

Drupal site is enabled in iframe

Answer 4

It's also worth checking if your parent site is using https then the iframe link attribute also needs https.

Answer 5

For anyone still maintaining an Drupal 7 site, I found a solution after some trial and error:

drupal_add_http_header('X-Frame-Options', FALSE);

This solution is good if you want a particular page to be embedded in an iframe, rather than the whole site (setting at the config level)

The method in drupal 7 core that automatically adds this header looks to see if the header exists at all and adds a "SAMEORIGIN" value if it does not exist. You just need to make sure to put something there so it skips over and doesn't add this pesky header.