Running EE 3.5.11

In the portfolio section of my website, I display websites that I have built using an iFrame. Most of them work and display properly, but there are a handful of ExpressionEngine sites that I built that do not show properly, but instead I get the following console error:

does not permit cross-origin framing

One that works correctly: http://rouviere.com/our-work/project/se-wind-supply-chain-map

One that does not work correctly: http://rouviere.com/our-work/project/cameron-clinic

They all use the same code for the iFrame:

<iframe id="webview"  src="{website_url}"></iframe>

I contacted the host for the sites that do not display in the iFrame and they said that they do not have any server settings that would be blocking cross-origin framing.

Any suggestions for solving this would be appreciated.

2 Answers 2


Le sigh... I always forget to RTFM.


You can set it in your config.php to NONE.

Edit Just FFS, here's how I figured it out:

cd ~/ee3-path/
grep -nr X-Frame-Options

Results had this line:

ee()->output->set_header('X-Frame-Options: '.$frame_options);

Next up:

grep -nr \$frame_options


$frame_options = ee()->config->item('x_frame_options');

Hrmm config...damnit, config item.

  • 1
    Problem solved. Well done sir!
    – forrest
    Dec 28, 2017 at 4:23

They do. They are just not trying for you, or are not able to figure out where the header is being set. It is perhaps being set by a reverse-proxy like CloudFlare. Perhaps try adding the sandbox attribute to your iframe and see if setting allow-same-origin helps your issues.

Read up on the attribute here:


Yes, to confirm, your iframe that isn't loading is at a url that is giving this response header:


Outside of the frame. They are serving that X-Frame-Option some how. Having dealt with people like this...

One suggestions; learn to use curl to output response header. Then send the web host support your exact CLI curl command and output, so they can't say "Hurr durr it's not true". You often have to shove it in someones face to get them to understand and actually try for you.

Edit If you have access to these sites servers, look in the vhosts files, the htaccess files, and your index.php file. Header can be set in any of those files. Also looks like that site is fronted by nginx, so perhaps it is an nginx setting (don't know nginx well enough to direct you), or more commonly nginx is used as a reverse proxy (think CDN).

  • Thank you for the response and assessment. I checked with the host and they ran a header test on the following URL, which is just a simple php file jlloydmorgan.com/headertest.php using webconfs.com/http-header-check.php and there is no reference to the X-Frame-Options => SAMEORIGIN, however if you run the same check on the root domain, it does show that. So there is something happening within ExpressionEngine to generate that. Any ideas what within EE could be doing that?
    – forrest
    Dec 27, 2017 at 22:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.