I'm embedding a specific "contact us" page from our marketing site into our web application using an iframe. Our marketing site is the primary domain, while the web application exists on a subdomain (but same top level domain).

When embedding the form page, the browsers refuses to render it because Craft automatically sets X-Frame-Options to sameorigin.

Browser message

Refused to display ... in a frame because it set 'X-Frame-Options' to 'sameorigin'.

Attempted Fixes

I have tried updating our CSP in nginx to allow for the subdomain, however X-Frame-Options remains present so the browser never allows the embed.

add_header Content-Security_Policy "frame-ancestors 'self' *.oursite.com https://localhost:4200;";

I have tried:

  • Using proxy_hide_header 'X-Frame-Options'; in our config
  • Attempting to set {% header "X-Frame-Options: ''" %} in my index.twig

1 Answer 1


And it was user rrror

It helps to spell "Content-Security-Policy" correctly.

However, if you still have issues with X-Frame-Options

We are using a docker image for craft which includes an nginx partial: craftcms/security.conf


Within that file is the X-Frame-Options header. The solution was to remove the reference to craft/security.conf and migrate its contents to our default.conf.

You can then remove the X-Frame-Options header and inserted your own CSP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.