I have a Drupal 7 site and a Facebook page. I have created a tab on the Facebook page which should allow me to display a page from my Drupal site within the tab. On Microsoft Edge I get a warning saying that the site doesn't allow iframes, on all other browsers I have tried nothing displays at all.

I have enabled Security Kit, disabled X-XSS-Protection, allowed cross-site request from https://facebook.com and disabled X-Frame-Options.

I enabled the iFrame entity module and allowed nodes to be iFramed.

And I have put $conf['x_frame_options'] = ''; in my settings.php.

I still am unable to display a node from my site on an iframe.

How do I get around this?



1 Answer 1


I put this towards the end of settings.php (Drupal 7). It worked for me:

$conf['x_frame_options'] = 'ALLOW-FROM .facebook.com';

(I also use SSL/https (Let's Encrypt) on this site.)

x_frame_options don't allow for multiple values, i think. So 'allow-from domain.com' might disallow SAMEORIGIN. From this post it looks like the module Security Kit allow for setting Allow-From dynamically based on the current page request. I haven't tested it myself.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.