Error map
Refused to display in a frame Console: Refused to display 'https://…' in a frame because it set 'X-Frame-Options' to 'deny' / 'sameorigin'
Browser · layer 1, On your device
Centre: this error. First ring: errors it is linked with (7). Outer ring: what those are linked with. Colours show the layer of a request each error belongs to. Click any dot to re-centre the map on it; hover to follow its connections. The centre dot opens the error page.
Directly related (7)
Refused to load the script because it violates the following Content Security Policy directive
The page’s Content-Security-Policy doesn’t allow that script, style, image or connection source.
SecurityError: Blocked a frame with origin "x" from accessing a cross-origin frame.
Script tried to read or modify an iframe (or window) from another origin.
This Set-Cookie was blocked because it had the "SameSite=Lax" attribute but came from a cross-site response / SameSite=None requires Secure
The browser refused to store or send an auth/session cookie because of SameSite or Secure rules — so logins don’t “stick” across…
Chrome: You cannot visit example.com right now because the website uses HSTS (NET::ERR_CERT_… no bypass)
The site told browsers to use only valid HTTPS (HSTS), so Chrome hides the "Proceed anyway" link when its certificate has any pro…
Chrome: Aw, Snap! Something went wrong while displaying this webpage. Error code: STATUS_ACCESS_VIOLATION / SIGILL / Out of Memory
A Chrome tab crashed — out of memory, a faulty extension, a graphics/driver issue or a very heavy page.
Console: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://a.com') does not match the recipient window's origin ('https://b.com')
`window.postMessage()` was sent with a `targetOrigin` that differs from the receiving window's real origin, so the message is dro…
Console: [Violation] Permissions policy violation: camera is not allowed in this document (Feature-Policy)
A browser feature (camera, microphone, geolocation, fullscreen, payment…) was blocked by a `Permissions-Policy` header or an ifra…
Two steps away (19)
Warning: Cannot modify header information - headers already sent
You called `header()`, `setcookie()` or `session_start()` after output had already been sent to the browser.
CORS Error: No 'Access-Control-Allow-Origin' header is present
The browser blocked a cross-origin request because the server’s response didn’t include the CORS headers allowing your site’s ori…
HTTP 411 Length Required
The server refuses a request with a body but no Content-Length header.
Mixed Content: The page was loaded over HTTPS, but requested an insecure resource
An HTTPS page tried to load a script, API or image over plain HTTP, and the browser blocked (or warned about) it.
AbortError: The user aborted a request. / signal is aborted without reason
A fetch was cancelled through an AbortController (or the browser cancelled it).
Script error. (at line 0) — cross-origin error details hidden
An error happened in a script from another origin, and the browser hid the details.
AWS: ExpiredToken — The security token included in the request is expired
Temporary AWS credentials (STS/SSO/assumed role) have expired.
HTTP 431 Request Header Fields Too Large
The request headers — almost always cookies — exceed the server’s size limit.
Error: A cross-origin error was thrown. React doesn't have access to the actual error object in development.
An error happened in a script loaded from another origin, so the browser hid the details from React.
NET::ERR_CERT_AUTHORITY_INVALID (Your connection is not private)
The site’s certificate isn’t signed by a CA the browser trusts — self-signed, missing intermediates, or intercepted by a proxy.
NET::ERR_CERT_DATE_INVALID (certificate expired)
The site’s certificate has expired (or isn’t valid yet) — or the device clock is wrong.
Chrome: This site can’t be reached — example.com unexpectedly closed the connection. ERR_CONNECTION_CLOSED
The server closed the connection before finishing the TLS handshake or sending a response — typical for HTTP/HTTPS port mix-ups,…
Blue Screen: MEMORY_MANAGEMENT (Stop code 0x0000001A)
Windows detected a severe memory-management error — commonly faulty RAM, unstable memory settings or a bad driver.
RangeError: Invalid array length
An array was created or resized with a negative, fractional or enormous length.
Chrome: This page isn’t working — sent an invalid response. ERR_CONTENT_DECODING_FAILED
The response claims to be compressed (gzip/brotli) but cannot be decompressed — it was double-compressed, truncated or not compre…
Browser: This network requires you to sign in — captive portal (hotel, airport, café Wi-Fi) blocking HTTPS sites
The Wi-Fi needs a login or acceptance page first; until you complete it, secure sites fail with certificate or connection errors.
Console: SecurityError: Failed to execute 'toDataURL' / 'getImageData' on 'HTMLCanvasElement': Tainted canvases may not be exported
You drew an image from another origin onto a canvas without CORS permission, so the browser blocks reading pixels back out.
Console: NotAllowedError: Permission denied (getUserMedia — camera or microphone blocked)
The user (or the browser/OS/policy) denied camera or microphone access, so `navigator.mediaDevices.getUserMedia()` was rejected.
Console: User denied Geolocation / Only secure origins are allowed (geolocation) / GeolocationPositionError code 1
`navigator.geolocation` failed because the user blocked location, the page is not on HTTPS, or the OS has location services off.
Map another error
Popular: 4035004000xC000007BTypeErrorCritical error404NullPointerException