Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I am using a new domain for my WordPress directory in different server. When I click the meta links such "Login" or "register", I get this page:

This content cannot be displayed in a frame

To help protect the security of information you enter into this website, the publisher of this content does not allow it to be displayed in a frame.

What you can try: Open this content in a new window

How can I fix this?

share|improve this question
    
This just happens from the new domain .... –  user1973523 Jan 15 '13 at 4:37
    
Try entering the website URL in a new tab/window. It that doesn't work, enter http://yourdomain.com/wp-login.php in a new browser tab/window –  bungeshea_ Jan 15 '13 at 5:06

1 Answer 1

Since version 3.4 (or earlier?) WordPress sends a special HTTP header (not in HTML) on login and admin pages:

X-Frame-Options: SAMEORIGIN

enter image description here

So your browser will show you some text built into the browser, not sent from WordPress.

From wp-includes/default-filters.php:

add_action( 'login_init', 'send_frame_options_header', 10, 0 );
add_action( 'admin_init', 'send_frame_options_header', 10, 0 );

You could create a plugin and disable these headers:

remove_action( 'login_init', 'send_frame_options_header' );
remove_action( 'admin_init', 'send_frame_options_header' );

But then your login can be used for clickjacking. Someone might register a domain with a very similar name, embed your login as background iframe and log the login credentials when you try to type them in.

That’s not fictional. It actually happened, that’s why WordPress implemented this.

Drop the iframe. Try to find a better solution.

share|improve this answer
    
when I view Source code from the new domain ... this is the only what disappears : html><head><title>new domain title </title><meta name="description" content="content"><meta name="keywords" content="b,a1373f"></head> <frameset rows="100%" border="0" framespacing="0" frameborder="0"><frame name="main" src="sourceurl"; marginwidth="0" marginheight="0" scrolling="auto" noresize="noresize"></frameset><noframes></noframes></html> –  user1973523 Jan 15 '13 at 5:20
    
@user1973523 See my update. This happens in HTTP, not in HTML. –  toscho Jan 15 '13 at 6:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.