Problems began after I updated from 4.6.7 to 4.6.10. Checking out with Paypal standard doesn't work if the form is embedded in another site.

I get this message in the console:

Refused to display 'https://www.paypal.com/us/cgi-bin/webscr?cmd=_flow&SESSION=************' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.

Any Ideas

1 Answer 1


Yes, it's a security measure of paypal, you can't use it in an iframe.

I would suggest that instead of embedding the donation form, you simply put a link to your civicrm contribution page.

You might have another payment processor that is willing to work from within a frame (try stripe if you want), but you might get blocked in the future, because trying to "hide" what is the real domain of the form asking for money is something scammers would do when trying to trick victims to send them money when they think they are paying someone else

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.