How can I enable a Drupal site to be in an iframe and place it in basic html page.

If I try this:

<iframe src="drupal-site.com"></iframe>

then it doesn't show any result.

Any suggestions?

  • and does <iframe src="any-other-site"></iframe> works? maybe this is because of browser or some other errors – Alireza Tabatabaeian Aug 18 '16 at 13:22
  • Other sites are working but not drupal site. I think I should enable it somehow – DroDro Aug 18 '16 at 13:23
  • I think you'd better to search in stackoverflow instead and search why iframe tag does not work. I think it's not because of drupal – Alireza Tabatabaeian Aug 18 '16 at 13:25
  • @AlirezaTabatabaeian the iframe tag is working for other pages, only for the drupal one is not. – DroDro Aug 18 '16 at 13:26
  • 1
    @AlirezaTabatabaeian Maybe not in the old days, but it is now – Clive Aug 18 '16 at 13:26

Since Drupal 7.50, core is now protected against clickjacking by default (X-Frame-Options: SAMEORIGIN).

So by default, your Drupal site can only be embedded into a site on the same domain.

To change those settings, assuming of course you understand the associated risks, follow the advice in the change record:

  1. If you are using a module such as Security Kit that already writes the X-Frame-Options header on its own, that setting will be automatically respected (pending the patch at #2661644: Integrate with Drupal core clickjacking defense) and Drupal core will not overwrite it. The Security Kit module provides an administrative interface for setting this header, so it's a good choice if you need to override the default Drupal core behavior and aren't sure exactly how to do it.
  2. Alternatively, set the 'x_frame_options' variable via any standard method, for example in settings.php:

    // Turn off the X-Frame-Options header entirely, to restore the previous
    // behavior of allowing the site to be embedded in a frame on another site.
    $conf['x_frame_options'] = '';


    // Set the "DENY" option to prevent the site from ever being embedded in a
    // frame at all, even on this site itself.
    $conf['x_frame_options'] = 'DENY';

    See https://developer.mozilla.org/docs/Web/HTTP/Headers/X-Frame-Options for more information on the various options this header can take.

    Removing the header (as shown in the first example code snippet above) should not be done lightly, or else your Drupal site could be embedded on other sites and then the user tricked into doing actions they don't want.

  3. If you want to remove the X-Frame-Options header in hook_page_alter() or theme preprocess functions that run later you can remove the header like this (requires PHP >= 5.3):


0 down vote I have inserted the following line into settings.php

$conf['x_frame_options'] = 'ALLOW-FROM http:// thepage's domain which contain the iframe/';

and it works fine BUT only from Chrome browser. The Mozilla and Explorer does not care and NOT showing the homepage in iframe.

Now I've tried this:

$conf['x_frame_options'] = '';

It is also working well in Chrome but not in Firefox nor Explorer.

Finally the Security Kit has handled the situation when I turned the X-FRAME-OPTIONS HEADER off.

The ALLOW-FROM doesn't works in Mozilla and Explorer ONLY in Chrome.

It is strange that the referenced mozilla page (https://developer.mozilla.org/hu/docs/Web/HTTP/Headers/X-Frame-Options) says that it is supported in Firefox but no support in chrome 4.0 and actually it does'nt work in Firefox but works in Chrome.)


You just need to write:

$conf['x_frame_options'] = '';

Drupal site is enabled in iframe


It's also worth checking if your parent site is using https then the iframe link attribute also needs https.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.