Refused to display in a frame Browser Origin: On your device Last updated 15 Oct 2026

Console: Refused to display 'https://…' in a frame because it set 'X-Frame-Options' to 'deny' / 'sameorigin'

The page you tried to embed in an <iframe> forbids framing through the X-Frame-Options header or CSP frame-ancestors.

Exact message you may see Refused to display in a frame because it set 'X-Frame-Options'X-Frame-Options to 'deny'X-Frame-Options to 'sameorigin'frame-ancestors violates the following Content Security Policy directiverefused to connect frame-ancestors
Explore the map of this error Full error map →
Seen on: Chrome Firefox Nginx Apache

Meaning

Sites protect themselves against clickjacking by refusing to be framed. You cannot override this from the embedding page. Use the site's official embed URL, an API, or if you own both sites, allow your origin in frame-ancestors.

Common causes

  • Target sends X-Frame-Options: DENY or SAMEORIGIN
  • CSP frame-ancestors not including your origin
  • Embedding a login page or social site that never allows frames
  • Wrong URL for an embed (use /embed/ URLs for YouTube etc.)
  • Proxy adding the headers

⚡ Quick fix

  1. Use the provider's embed URL or widget
  2. If you own the target: allow your origin in Content-Security-Policy: frame-ancestors https://yourapp.com
  3. Link out instead of embedding

Detailed fix by platform

Nginx

  1. add_header Content-Security-Policy "frame-ancestors 'self' https://partner.example.com" always; (and drop the old X-Frame-Options)

Apache

  1. Header always set Content-Security-Policy "frame-ancestors 'self' https://partner.example.com"

JavaScript

  1. Check the response: fetch(url).then(r => console.log(r.headers.get('x-frame-options'), r.headers.get('content-security-policy'))) (same-origin only)

How to diagnose

  1. Headers — X-Frame-Options or frame-ancestors on the target?
  2. Ownership — Do you control the target site?
  3. Alternative — Official embed URL?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: On your device. Errors that are often confused with or caused by this one (click to open):

Aw, Snap! — Chrome: Aw, Snap! Something went wrong while displaying this webpage. Error code: STATUS_ACCESS_VIOLATION / SIGILL / Out of Memory (Browser)Aw, Snap!blocked a frame — SecurityError: Blocked a frame with origin "x" from accessing a cross-origin frame. (JavaScript)blocked a frameCSP violation — Refused to load the script because it violates the following Content Security Policy directive (JavaScript)CSP violationFailed to execute postMessage — Console: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://a.com') does not match the recipient window's origin ('https://b.com') (Browser)Failed to execute pos…HSTS — Chrome: You cannot visit example.com right now because the website uses HSTS (NET::ERR_CERT_… no bypass) (Browser)HSTSPermissions policy violation — Console: [Violation] Permissions policy violation: camera is not allowed in this document (Feature-Policy) (Browser)Permissions policy vi…SameSite cookie blocked — This Set-Cookie was blocked because it had the "SameSite=Lax" attribute but came from a cross-site response / SameSite=None requires Secure (Authentication)SameSite cookie block…Refused t…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.