X-Frame-Options header is used to control whether your site can be included in frames on other sites -
SAMEORIGIN will allow you to host your site in an iFrame, whilst
DENY will block everyone, including you.
The Content Security Policy then controls what sites you can include in various elements of your site (images, frames, scripts, etc.).
The CSP can be set either in the metadata or via the headers sent in the response - note however that multiple directives make the policy more restrictive, not less.
If you only have a limited set of sources you are serving frames from, you can add all the domains to the policy, however if there can be arbitrary domains you may be better just using the scheme directive:
Only allow frames from
https://example.com/ requests to
https://www.example.com will be blocked:
Content-Security-Policy: frame-src https://example.com/
Allow frames from any secure site:
Content-Security-Policy: frame-src https:
Running your site under IIS, even with PHP, you should still have a
web.config in the root of your site - the following section can be added (or adjusted) to set these headers on all outbound requests:
<!-- Remove the default X-Frame-Options header -->
<remove name="X-Frame-Options" />
<!-- Add CSP header with frame and default sources allowing HTTP and HTTPS, and inline scripts -->
<add name="Content-Security-Policy" value="frame-src https: http; default-src https: http: 'unsafe-inline' 'unsafe-eval'" />
<!-- Set a CORS header to allow requests from anywhere -->
<add name="Access-Control-Allow-Origin" value="*" />
Note however the following constraints, many of which are applied by the browsers directly:
- If your site is served over HTTPS, the frame contents will be blocked (regardless of the CSP) if it's requested over HTTP (you might be able to use the
upgrade-insecure-requests directive to get around that if the requested site also responds on HTTPS).
- If the requested site sends its own CORS headers, and they don't include your domain (or
*), the browser will block those requests
- If the requested site sends an
X-Frame-Options header of
DENY the browser will block those requests.