Skip to content
iframecheck

net::ERR_BLOCKED_BY_RESPONSE in an iframe

Chrome and Edge use this error code when a response header does not allow the load. In a frame the header is X-Frame-Options, CSP frame-ancestors, or Cross-Origin-Resource-Policy.

  • Chrome
  • Edge

Updated

Error code · Chrome and Edge, exact text

net::ERR_BLOCKED_BY_RESPONSE

Chrome, EdgeExact text

The frame shows a gray page: “example.com refused to connect.”

net::ERR_BLOCKED_BY_RESPONSE

On this page

What it means

The connection worked. The browser got the page and then stopped it because of a header in the answer. Chrome names this case ERR_BLOCKED_BY_RESPONSE, and the frame shows “refused to connect.” Other browsers block the same page with their own words. Test the URL to see the headers.

Why it happens

The server answered, but the answer came with a rule that the load does not meet. For a frame, Chrome uses this code for:

  1. X-Frame-Options DENY or SAMEORIGIN on a page from another origin.

  2. CSP frame-ancestors that does not list your site.

  3. Cross-Origin-Resource-Policy, when your page sends Cross-Origin-Embedder-Policy: require-corp. The code then has a reason after a dot, such as .NotSameOriginAfterDefaultedToSameOriginByCoep.

Check the page

See the headers the page sends now

Fix it if you own the site

Find the header in the console line or in the Network panel. For X-Frame-Options and frame-ancestors, allow your site on the server of the framed page. Pick your server. For the COEP case, read the COEP error page.

location / {
  proxy_hide_header X-Frame-Options;
  add_header Content-Security-Policy "frame-ancestors 'self' https://your-site.com" always;
}
nginx.confReplace your-site.com with the site that embeds this page.

Do not use X-Frame-Options ALLOW-FROM. Modern browsers ignore it. Do not add * to frame-ancestors unless any site may embed the page.

If you do not own the site

You cannot remove the header from your side. No iframe attribute or proxy trick is a safe fix. Use one of these.

  1. Use the official embed URL

    YouTube, Google Maps, Calendly, and others give a special embed link that allows frames.

  2. Link out instead

    Open the page in a new tab with a normal link, or show a preview card that links to it.

  3. Ask the owner

    Ask them to add your site to frame-ancestors. Send them this page.

Sources

Know before you embed.

Free, no sign-up, nothing stored. Paste a URL and get a verdict, a live preview, and the fix.

Test a URLBrowse guides