Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to display an Excel document from SharePoint2010 Excel Services in an iframe. But I'm getting an error due to the x-frame-options header. I have access to the to SharePoint server and all online searches tell me to go to IIS Manager -> HTTP Response Headers to remove it. But it's not there.

I tried adding my own header as suggested here: to no avail.

I also tried changing a SharePoint setting suggested here: Disabling X-FRAME-OPTION: SAMEORIGIN HTTP Response Header on SharePoint/PowerPivot xlsviewer.aspx. That didn't work either.

It's not a proxy adding it or anything because other SharePoint sites on the network do not have the header.

Is there another place x-frame-options could be set?

UPDATE: After more investigating, it turns out only the SharePoint Excel Services page (xlviewer.aspx) includes x-frame-options = SAMEORIGIN. So one would assume there's a setting in SharePoint.

share|improve this question
up vote 0 down vote accepted

So it doesn't look like you can turn it off in SharePoint Admin. I ended up installing an HttpModule to strip out offending header and it works great.

share|improve this answer
Removing the X-Frame-Options: SAMEORIGIN header will expose your site to Clickjacking attacks. You should use X-Frame-Options: ALLOW-FROM or, better, replace it with Header set content-security-policy frame-ancestors 'self' – Mircea Vutcovici May 24 at 17:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.