Iframe errors and how to fix them
19 browser errors that stop an iframe, in 3 groups. Each page shows the exact message, the cause, and the fix.
Updated
Browser
Blocked by headers
8 errors
The page you embed sends a header that forbids frames on your site.
- Refused to display … because it set 'X-Frame-Options' to 'sameorigin'.The site allows frames only on its own origin.
- Chrome
- Edge
- Safari
- Refused to display … because it set 'X-Frame-Options' to 'deny'.The site allows no frames at all, not even on its own pages.
- Chrome
- Edge
- Safari
- Framing '…' violates the following Content Security Policy directive: "frame-ancestors …".CSP frame-ancestors does not list your site.
- Chrome
- Edge
- Refused to load … because it does not appear in the frame-ancestors directive …Safari wording for the same frame-ancestors block.
- Safari
- example.com refused to connect.The text inside the frame when a header blocks it.
- Chrome
- Edge
- net::ERR_BLOCKED_BY_RESPONSEA response header stopped the load: X-Frame-Options, CSP, or CORP.
- Chrome
- Edge
- Firefox Can’t Open This PageThe Firefox frame page for X-Frame-Options or frame-ancestors.
- Firefox
- net::ERR_BLOCKED_BY_RESPONSE.NotSameOriginAfterDefaultedToSameOriginByCoepYour page sends COEP require-corp, and the frame does not opt in.
- Chrome
- Edge
- Safari
Cookies and login
4 errors
The frame loads, but the browser does not send its cookies, so login fails.
- This attempt to set a cookie via a Set-Cookie header was blocked because it had …The cookie has SameSite=Lax or no SameSite, so the frame does not get it.
- Chrome
- Edge
- Cookie “…” has been rejected because it is in a cross-site context and its “SameSite” …Firefox wording for the same SameSite block.
- Firefox
- Third-party cookie blocked in Chrome due to Chrome flags or browser settingsChrome limits cookies in frames from other sites.
- Chrome
- Firefox
- Login loop: the sign-in page loads again inside the frameThe session cookie is blocked. Use CHIPS or the Storage Access API.
- All browsers
Scripts and sandbox
7 errors
Scripts cannot reach a frame on another origin, or the sandbox blocks them.
- SecurityError: Failed to read a named property 'document' from 'Window': Blocked a frame …Your script reads the page of a frame on another origin.
- Chrome
- Edge
- Safari
- Permission denied to access property "document" on cross-origin objectFirefox wording for the same cross-origin block.
- Firefox
- Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('…') does not match …The targetOrigin in postMessage does not match the frame.
- All browsers
- Blocked script execution in '…' because the document's frame is sandboxed …The sandbox attribute does not have allow-scripts.
- Chrome
- Edge
- Safari
- Blocked form submission to '…' because the form's frame is sandboxed and the 'allow-forms' …The sandbox attribute does not have allow-forms.
- Chrome
- Edge
- Safari
- Unsafe attempt to initiate navigation for frame with origin '…' from frame …The frame tries to change the top page without allow-top-navigation.
- Chrome
- Edge
- Safari
- Blocked opening '…' in a new window because the request was made in a sandboxed frame …The sandbox attribute does not have allow-popups.
- Chrome
- Edge
- Safari