I have two wordpress sites I'll call one sourceURL and the one destinationURL. destinationURL has an iframe to present content from the sourceURL. When I attempt to run the iframe presenting the content from the other I get the following error:
destinationURL refused to display sourceURL in a frame because it set 'X-Frame-Options' to 'sameorigin'.
I can't seem to find where the x-frame option is being set by wordpress. I checked the following:
.htaccess - I removed any security options I had in the htaccess file. I also tried to enable x-frame via the htaccess. Doing this gives me an error that I have two conflicting rules.
<IfModule mod_headers.c> Header set X-Frame-Options "ALLOW-FROM destinationURL“ </IfModule>all root wp- related files. I can't seem to find any config updating the setting.
- plugins - I removed security plugins in case they were setting my option to sameorigin, and I tried plugins that are meant to update the x-frame option.
At this stage, I suspect wordpress has a default configuration.
How does wordpress restrict x-frame options to sameorigin?
I was hoping one of you experienced this before and walk me through how wordpress disables x-frame options before I grep for 'x-frame' or sameorigin across all the files.
--Update--
I created a wordpress plugin to remove their security as the variable. I realized afterwards that the X-Frame Error I was receiving was lowercase (sameorigin), which highlighted that it wasn't coming from wordpress as their files all are set to uppercase.
I spoke to my web hosting provider and discovered they set their apache config to restrict X-Frames.
To correct my issue, I added the following line to my .htaccess file. Hope this helps someone.
Header always unset X-Frame-Options