add_filter('wp_anti_clickjack', '__return_false' );
If you’d like to disable the clickjacking X-Frame-Options HTTP header you can use this filter in your theme’s functions.php file.
add_filter('wp_anti_clickjack_x_frame_options_header', '__return_false' );
my question is, how do I do this if I want to avoid x frame options in a specific elementor page or URL.
Thanks for your help.
I have been using this great plugin for quite some time but I have noticed that
the previously working header X-Frame-Option (which I set to sameorigin) does not work anymore.
Link: https://gyazo.com/af985fb9b9e60b626112d65a920d080b
Test of headers: https://gyazo.com/33aa8ab45dea3aa92f3dd3c2d549014f
I have a question about the Sucuri plugin for WordPress:
1) Sucuri made recommendations for my site (shown in the dashboard):
a) Security Header: X-Frame-Options:
We did not find the recommended security header for ClickJacking Protection on your site.
b) Security Header:
X-Content-Type-Options nosniff: We did not find the recommended security header to prevent Content Type sniffing on your site.
2) I made the suggested changes as instructed in the recommendations
3) Sucuri did a scan of the site and continues to list the same recommendations as before. This has happened multiple times.
Any ideas?
Thanks
Richard
]]>Refused to display 'https://www.facebook.com/v2.4/plugins/page.php......' in a frame because it set 'X-Frame-Options' to 'deny'.
in my .htaccess file i added this line code
Header always set X-Frame-Options “SAMEORIGIN”
but the problem still there
]]>My site would not load properly. Chrome dev tools giving error:
Refused to display 'https://cabgrid.com/help-and-support/custom-styles/changing-one-way-return-icon-button/?et_fb=1&et_bfb=1&PageSpeed=off' in a frame because it set multiple 'X-Frame-Options' headers with conflicting values ('allow-all, SAMEORIGIN'). Falling back to 'deny'.
Solution:
Comment out following line found in MailPoet plugin code (/wp-content/plugins/mailpoet/lib/Form/Widget.php line 49)
header('X-Frame-Options: allow-all', true);
Longer version:
WordPress 5.4
MailPoet 3.46.10
Server NGINX 1.16.1
Theme Divi 4.4.3
Divi loads its builder in the admin via an iFrame. Recently, the builder failed to load (hung).
Examining the Chrome dev tools the above mentioned error became apparent. Looking at the Network tab, I saw two headers returned for x-frame-options:
x-frame-options: allow-all
x-frame-options: SAMEORIGINMy NGINX configuration sets the SAMEORIGIN http header, but I could not find the source of the allow-all header. When loading a stand-alone PHP file on my site I only received the SAMEORIGIN header, so the problem must be within WordPress (not a server misconfiguration).
I also noted I was not getting the same problem on similar sites on the same server.
After some hunting through the site’s code I discovered the line above in MailPoet’s widget.php file. This file appears to extend WordPress’s own widget class, so is probably being executed beyond its intended context.
In any case, commenting out line 49 (as mentioned above) removed the second x-frame-options header and now the Divi builder loads properly.
Question is, have I now borked some functionality within MailPoet?
Thoughts?
]]>it’s these 3
Security Header: X-XSS-Protection Missing
Security Header: X-Frame-Options
Security Header: X-Content-Type nosniff
i added to .htaccess in both admin and front:
<IfModule mod_headers.c>
Header set X-XSS-Protection “1; mode=block”
</IfModule>
<IfModule mod_headers.c>
Header always append X-Frame-Options SAMEORIGIN
</IfModule>
<IfModule mod_headers.c>
Header set X-Content-Type-Options nosniff
</IfModule>
I’m trying to figure out which is causes this error.
I receive this error:
Refused to display ‘https://www.facebook.com/xti.php?xt=[…]’ in a frame because it set ‘X-Frame-Options’ to ‘sameorigin’.
There are alot of characters between []. I’m wondering if facebook sdk can cause that. Anyone want else has already faces this error?
I get this error when I add the facebook page plugin. Everythings works, but I want to know why I get this error.
The error appear when I tabbed out then I come back to the website.
Thanks
]]>