◆Error Codes Wiki

Cross-Origin Iframe Blocked — X-Frame-Options and frame-ancestors Policy Error

Warningsecurity

Overview

Fix cross-origin iframe embedding failures caused by X-Frame-Options DENY/SAMEORIGIN headers or Content-Security-Policy frame-ancestors directives.

Key Details

  • X-Frame-Options and CSP frame-ancestors control whether a page can be embedded in an iframe
  • X-Frame-Options: DENY blocks all framing; SAMEORIGIN allows only same-origin framing
  • CSP frame-ancestors is the modern replacement: frame-ancestors 'self' https://allowed-domain.com
  • These headers prevent clickjacking attacks where malicious sites embed your site in a hidden iframe
  • The blocked page shows an error in the browser console: 'Refused to display in a frame'

Common Causes

  • Target site sets X-Frame-Options: DENY or SAMEORIGIN, blocking all cross-origin embedding
  • CSP frame-ancestors directive does not include your domain in the allowed list
  • Browser enforcing stricter framing policies for cross-origin content
  • Intermediate proxy or CDN adding X-Frame-Options headers to responses

Steps

  1. 1Check the blocked page's response headers: DevTools > Network > select request > Headers tab
  2. 2If you control the embedded site: add your domain to frame-ancestors: Content-Security-Policy: frame-ancestors 'self' https://your-domain.com
  3. 3Replace X-Frame-Options with CSP frame-ancestors for more granular control
  4. 4If you do not control the embedded site: use their API or embed SDK instead of iframing
  5. 5Use the sandbox attribute on the iframe for additional security when embedding third-party content

Tags

iframex-frame-optionsframe-ancestorscspclickjacking

Related Items

browser-cors-preflight-request-failedbrowser-csp-inline-script-blocked

More in Security

windows-defender-errorsWindows Defender Errors — Antivirus Not Working or Updating
Error
windows-error-0x80073b01-defender-serviceWindows Error 0x80073B01 — Windows Defender Service Failed to Start
Error
windows-bitlocker-recovery-key-errorsBitLocker Recovery Key Errors — Drive Locked and Recovery Key Not Found
Critical
mac-gatekeeper-app-blockedMac Gatekeeper — App Cannot Be Opened (Unidentified Developer)
Warning
mac-filevault-recovery-errorsMac FileVault Errors — Encryption, Decryption & Recovery Key Issues
Error
mac-keychain-errors-passwordsMac Keychain Errors — Password Prompts, Locked Keychain, and Repair Guide
Warning

Frequently Asked Questions

Use CSP frame-ancestors. It is the modern standard, supports multiple allowed domains, and overrides X-Frame-Options. X-Frame-Options only supports DENY and SAMEORIGIN. Set both for backward compatibility with older browsers.