I noticed this question, which discusses various ways to alter HTTP Response Headers.

Where would I be able to execute:


I attempted to place this within my THEMENAME.theme file, but perhaps I am not doing it right because $response is not defined where I am using it.

Where does $response come from?

Where can I execute $response->headers->remove('X-Frame-Options');?

Note: I understand the risks of removing the HTTP Header. This is for development/testing purposes only.

  • Sounds like it should be an EventSubscriber to me.
    – Kevin
    Commented Jul 7, 2017 at 21:41
  • @Kevin, are custom modules required for EventSubscribers? Commented Jul 7, 2017 at 22:41
  • Yes. Check some of the docs and blogs about them.
    – Kevin
    Commented Jul 7, 2017 at 22:43
  • @Kevin, can you clarify where a custom service should live relative to the root Drupal installation? I've tried from the root level and also from /modules, and Drupal is not picking up my Event subscription. Commented Jul 8, 2017 at 2:06

1 Answer 1


Got it!

From these two sources:

I realized that I was missing a mymodule.info.yml file.

  ├── mymodule.info.yml 
  ├── mymodule.services.yml 
  └── src 
    └── EventSubscriber 
      └── RemoveXFrameOptionsSubscriber.php

Then, go to /admin/modules in the backend (Extend tab) and install the new module & clear all caches afterwards.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.