I have a site that, by necessity, needs to load into an iFrame on another site. Part of the site is a Channel Form however this page won't load into the iFrame because the X-Frame-Options header is being set. I see the addition of this header was an update in 2.5.

Does anyone know how I can stop this header from being set? I don't think I have any option other than to modify the Core but I can't find where it's being set.


I have found where the header is being set...

It's within system/expressionengine/libraries/Cp.php:

73          // Make sure all requests to iframe the CP are denied
74:         ee()->output->set_header('X-Frame-Options: SameOrigin');

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.