Refused to display in a frame: X-Frame-Options deny

What it means

Why it happens

1. 01

   DENY blocks every frame. SAMEORIGIN blocks only frames on other origins.

2. 02

   Banks, sign-in pages, and admin panels often send it to stop clickjacking.

3. 03

   Chrome writes the value in lower case. Safari writes it as the server sent it. The meaning is the same.

4. 04

   If the page also sends CSP frame-ancestors, browsers follow frame-ancestors and ignore this header.

Check the page

Fix it if you own the site

location / {
  proxy_hide_header X-Frame-Options;
  add_header Content-Security-Policy "frame-ancestors 'self' https://your-site.com" always;
}

If you do not own the site

1. 01
   Use the official embed URL

   YouTube, Google Maps, Calendly, and others give a special embed link that allows frames.

2. 02
   Link out instead

   Open the page in a new tab with a normal link, or show a preview card that links to it.

3. 03
   Ask the owner

   Ask them to add your site to frame-ancestors. Send them this page.

Sources

• Chromium source: ancestor_throttle.cc
• Firefox source: security.properties
• WebKit source: NetworkResourceLoader.cpp
• MDN: X-Frame-Options header
• RFC 7034: HTTP Header Field X-Frame-Options