# Console: Refused to display 'https://…' in a frame because it set 'X-Frame-Options' to 'deny' / 'sameorigin'

**Code:** `Refused to display in a frame` · **Category:** Browser · **Seen on:** Chrome, Firefox, Nginx, Apache

The page you tried to embed in an `<iframe>` forbids framing through the `X-Frame-Options` header or CSP `frame-ancestors`.

## Meaning

Sites protect themselves against clickjacking by refusing to be framed. You cannot override this from the embedding page. Use the site's official embed URL, an API, or if you own both sites, allow your origin in `frame-ancestors`.

## Common causes

- Target sends `X-Frame-Options: DENY` or `SAMEORIGIN`
- CSP `frame-ancestors` not including your origin
- Embedding a login page or social site that never allows frames
- Wrong URL for an embed (use /embed/ URLs for YouTube etc.)
- Proxy adding the headers

## Quick fix

1. Use the provider's embed URL or widget
2. If you own the target: allow your origin in `Content-Security-Policy: frame-ancestors https://yourapp.com`
3. Link out instead of embedding

## Detailed fix by platform

### Nginx

1. `add_header Content-Security-Policy "frame-ancestors 'self' https://partner.example.com" always;` (and drop the old `X-Frame-Options`)

### Apache

1. `Header always set Content-Security-Policy "frame-ancestors 'self' https://partner.example.com"`

### JavaScript

1. Check the response: `fetch(url).then(r => console.log(r.headers.get('x-frame-options'), r.headers.get('content-security-policy')))` (same-origin only)

## How to diagnose

1. **Headers** — X-Frame-Options or frame-ancestors on the target?
2. **Ownership** — Do you control the target site?
3. **Alternative** — Official embed URL?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/browser/refused-to-display-x-frame-options)