Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have an mp3 player that runs via an iFrame, not our choice but thats how we're stuck with it. We want to prevent other people simply embedding the iframe on their site.

What would be the best way to do this? We're running nginx so no .htaccess. The mp3 player is made up of php files and we need to keep running it in an iframe.

Is there anyway to lock the specific mp3 players php file (in this case html5player.php) to only be able to be executed on our server or domain name? Surely there is a way to do that in nginx? But then of course, if they embed the iFrame it will think it IS running on our server anyway wont it?

Everything solution I've thought of has fallen down somewhere along the way, so input much appreciated.

share|improve this question
up vote 1 down vote accepted

Sounds like a job for the X-Frame-Options header:

add_header X-Frame-Options SAMEORIGIN;

(Applied to a location matching the file in question, obviously)

You could also add the header in PHP, which may be easier.

Make sure to add the header exactly once, or it will be ignored by some browsers, causing a lot of "fun" when debugging. See bug report for Chrome, bug report for Firefox.

share|improve this answer
Hmmm, I tried this, added it to my nginx file, which it read fine, but I can still load up on my other domain? – Danny Shepherd Feb 6 '13 at 21:08
Which browser are you using to test? Are you sure the header is being delivered? (Check with Wireshark, Firebug or the equivalent built-in tool in Firefox/Chrome.) – Jan Schejbal Feb 6 '13 at 23:00
Chrome and Safari on Mac. I added it as <?php header('X-Frame-Options: SAMEORIGIN'); ?> to the php file header as well as it didn't work when I added it to the nginx.conf (see above, NOTHING is having any effect in the .conf file, even simple hotlinking) But yes, didn't work when I added it as the first line of the php file either…. – Danny Shepherd Feb 6 '13 at 23:24
I've now added <?php header('X-Frame-Options: SAMEORIGIN'); ?> to every single php file the plugin calls inside the iFrame and it still loads with no problems on my other domain!! – Danny Shepherd Feb 6 '13 at 23:55
Enable error reporting <?php error_reporting(E_ALL); ?> to make sure you don't miss errors like "headers already sent". You need to include the header command in front of ANYTHING else, including invisible byte-order-marks many editors add to UTF8 files. – Jan Schejbal Feb 7 '13 at 8:04

I'm not an expert of NGINX but this could work theoretically:

location ~* \urltoyourplayer?$ {
  valid_referers none blocked yourdomain.fqdn;
    if ($invalid_referer) {
      return 403;

This should prevent embedding your player into other websites by reading the referrer URL, if it match your domain then OK, otherwise return error 403.

share|improve this answer
You can read that as well: – Martino Dino Feb 6 '13 at 17:57
Added this as… location ~* \ content/plugins/amazon-s3-cloud-mp3-player/html5/html5big.php?$ { valid_referers none blocked; if ($invalid_referer) { return 403; } } But can still run the player from my other URL, I also have the hotlinking script in my nginx conf files blocking php, mp3, images from appearing on anything other than my URL as well and still, the player embeds on my other domain! – Danny Shepherd Feb 6 '13 at 21:21
The location you're using is wrong, there goes the proper one: /wp-content/plugins/amazon-s3-cloud-mp3-player/html5/html5big.php The proper line is: location /wp-content/plugins/amazon-s3-cloud-mp3-player/html5/html5big.php { – Martino Dino Feb 6 '13 at 21:27
Thanks Martino, I'll try that now… From that link you sent me I tried… location /wp-content/plugins/amazon-s3-cloud-mp3-player/html5/ { valid_referers none blocked *; if ($invalid_referer) { return 403; } } Which should lock the entire folder, is my location incorrect there too? – Danny Shepherd Feb 6 '13 at 21:31
I believe it's correct, yet I'm not sure that it will work for subsequent folders (like html5/folder/file), will try that now and post back the answer. – Martino Dino Feb 6 '13 at 21:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.