I see that Drupal now automatically adds the 'X-Frame-Options: SAMEORIGIN' header. However, the client would like to give explicit permission to allow a iframe embed to another site.

How do I allow iframe embeds to a particular domain?


If I'm understanding you correctly, this is actually an Apache setting. X-Frame-Options by default are SAMEORIGIN for security reasons. This option helps secure your site again various attacks.

To allow a specific domain to access your site (cross origin) you find the X-Frame-Options setting in your Apache configuration file and change it to say:

Header always append X-Frame-Options ALLOW-FROM=http://www.example.com

You will need access to the site server in order to do this. Also understand you will need to find the proper configuration file to add this to. Depending on the server setup this could be something different than the default httpd.conf or apache2.conf file.

  • Closer. I'm getting this now: Refused to display 'https://dis.site' in a frame because it set multiple 'X-Frame-Options' headers with conflicting values ('ALLOW-FROM=https://target.iframe.site, SAMEORIGIN'). Falling back to 'deny'. Can I calm down Drupal 7 without opening the site up to anyone <iframe>'ing it? – Rick Jun 1 '17 at 20:06
  • @rgchi variable_set('x_frame_options', FALSE); will stop Drupal adding the header. If you're adding it via server config anyway you don't need to worry about php doing it too – Clive Jun 1 '17 at 20:17
  • Also bear in mind Chrome doesn't support ALLOW-FROM – Clive Jun 1 '17 at 20:18


you can set security level and also set exceptions

  • May I ask in which area? The X-Frame-Options under "Clickjacking"? – Rick Jun 1 '17 at 20:24
  • That's correct. – Rotari Radu Jun 19 '17 at 8:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.