0

Right now, anyone can display my website with an <iframe> tag.

See example:

<iframe src="http://example.com/" width="1000" height="1800" frameborder="0" scrolling="no"></iframe>

How can I block a website from doing that?

I prefer use code than a plugin, Thank you, Shay.

1

1 Answer 1

3

WordPress has a built-in function to send the X-Frame-Options header: send_frame_options_header(). It is used by default on the login and admin pages.

If you want to enable it always, just add it for front end views:

add_action( 'template_redirect', 'send_frame_options_header' );

But … it doesn't send Content-Security-Policy headers. If you want to have a more complete solution and disable any frame, even from the same site, you can use:

function no_frame_headers()
{
    header( "X-Frame-Options: DENY", true );
    header( "Content-Security-Policy: frame-ancestors 'none'", true );
}

And then register that callback:

add_action( 'login_init',        'no_frame_headers', 1000 );
add_action( 'admin_init',        'no_frame_headers', 1000 );
add_action( 'template_redirect', 'no_frame_headers', 1000 );

This has to go into a plugin, of course.

4
  • does this options will still let me show my website on my website via iframe?
    – Shay S
    May 8, 2017 at 14:42
  • @ShayS Then you have to use frame-ancestors 'self' and X-Frame-Options: SAMEORIGIN.
    – fuxia
    May 8, 2017 at 14:47
  • thank you for responding! , what do you mean i have to use these? i need to add them to what you gave me?
    – Shay S
    May 8, 2017 at 18:11
  • @ShayS Yes, replace the parts in my code sample.
    – fuxia
    May 8, 2017 at 20:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.