I have an internal WordPress site that I'm trying to embed via iFrame. Currently, I'm stuck on:

Error: Cookies are blocked or not supported by your browser. You must enable cookies to use WordPress.

I have tried to add the following to my .htaccess:

<IfModule mod_headers.c>
Header set Access-Control-Allow-Origin https://parent.com
Header set X-Frame-Options ALLOWALL
Header always edit Set-Cookie (.*) "$1;Secure;SameSite=none"

<IfModule LiteSpeed>
ForceSecureCookie secure same_site_none

However, the cookies still appear without SameSite=None:

enter image description here

When I try to set a custom cookie:

function add_cookie( ) {
    $cookie_options = array(
        'expires' => time() + 3600,
        'path' => '/',
        'domain' => 'xxx.com', // leading dot for compatibility
        'secure' => true, // only transmit over HTTPS
        'httponly' => true, // make cookie accessible through HTTP protocol only
        'samesite' => 'None' // None || Lax || Strict

    $set_cookie = setcookie( 'wp-test-cookie', 'samesite', $cookie_options );

add_action( "login_init", "add_cookie" );

It sets it correctly:

enter image description here

Any suggestions?

  • it's very likely that your iframe HTML imposes restrictions on cookie, but since you've shared no information about how your embedding is working or why you're embedding it's difficult to figure out the problem, and the answer you shared below won't make any sense
    – Tom J Nowell
    Commented Apr 16, 2023 at 18:23
  • @TomJNowell it doesn't matter how it's embedded as the issue is with how the cookie is set.
    – Kermit
    Commented Apr 16, 2023 at 19:05

1 Answer 1


I installed the SameSite plug-in which mimics the default PHP setcookie behavior and adds the additional parameter (samesite) to the cookie. I set the plug-in configuration in wp-config.php with:

define( 'WP_SAMESITE_COOKIE', 'None' );

By setting the configuration of samesite=None, browsers will not enforce SameSite rules that are used to prevent CSRF. From the Mozilla blog:

Attackers can abuse the fact that cookies are automatically sent with every request to force a user to perform unwanted actions on the site where they are currently logged in. Such attacks, known as cross-site request forgeries (CSRF), allow attackers who control third-party code to perform fraudulent actions on the user’s behalf. Unfortunately current web architecture does not allow web applications to reliably distinguish between actions initiated by the user and those that are initiated by any of the third-party gadgets or scripts that they rely on.

To compensate, the same-site cookie attribute allows a web application to advise the browser that cookies should only be sent if the request originates from the website the cookie came from. Requests triggered from a URL different than the one that appears in the URL bar will not include any of the cookies tagged with this new attribute.

For this use internal case, it will allow WordPress to be loaded via an iFrame.

  • what does the samesite plugin do and how does it answer the question?
    – Tom J Nowell
    Commented Apr 16, 2023 at 18:23
  • @TomJNowell hope that edit helps
    – Kermit
    Commented Apr 16, 2023 at 19:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.