I am using a new domain for my WordPress directory in different server. When I click the meta links such "Login" or "register", I get this page:

This content cannot be displayed in a frame

To help protect the security of information you enter into this website, the publisher of this content does not allow it to be displayed in a frame.

What you can try: Open this content in a new window

How can I fix this?

  • This just happens from the new domain .... – user1973523 Jan 15 '13 at 4:37
  • Try entering the website URL in a new tab/window. It that doesn't work, enter http://yourdomain.com/wp-login.php in a new browser tab/window – shea Jan 15 '13 at 5:06

Since version 3.4 (or earlier?) WordPress sends a special HTTP header (not in HTML) on login and admin pages:

X-Frame-Options: SAMEORIGIN

enter image description here

So your browser will show you some text built into the browser, not sent from WordPress.

From wp-includes/default-filters.php:

add_action( 'login_init', 'send_frame_options_header', 10, 0 );
add_action( 'admin_init', 'send_frame_options_header', 10, 0 );

You could create a plugin and disable these headers:

remove_action( 'login_init', 'send_frame_options_header' );
remove_action( 'admin_init', 'send_frame_options_header' );

But then your login can be used for clickjacking. Someone might register a domain with a very similar name, embed your login as background iframe and log the login credentials when you try to type them in.

That’s not fictional. It actually happened, that’s why WordPress implemented this.

Drop the iframe. Try to find a better solution.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.