I used to be able to embed CiviCRM forms in Iframes without issue. Recently, I haven't been successful and getting this error:

Refused to display 'http://website.com/civicrm/event/register?id=2' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.

  • Is this an iframe on the same domain or a different one? Feb 8 '17 at 0:02
  • Different domain
    – Yossi
    Feb 8 '17 at 0:14
  • In that case, it sounds like you're running into cross-domain iframe issues. I think this question falls outside the scope of this Stack Exchange unless there's something CiviCRM-specific about the issue. You can search for "iframe some origin policy" to see what's involved in cross-domain iframes. Feb 8 '17 at 0:21

Drupal core is now protected against clickjacking by default: https://www.drupal.org/node/2735873

You can install Security Kit module -> and then add specific allow-from domains.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.