1

Using Wordpress on Nginx.

I am receiving these errors but I can't seem to find out where in my Nginx options I have specified this 'DENY' header.

Multiple 'X-Frame-Options' headers with conflicting values ('SAMEORIGIN, DENY') encountered when loading 'https://beta.com/wp-admin/plugin-install.php?tab=plugin-information&plugin=duplicate-post&'. Falling back to 'DENY'.

Refused to display 'https://beta.com/wp-admin/plugin-install.php?tab=plugin-information&plugin=duplicate-post&' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN, DENY'.

load-scripts.php?c=1&load[]=jquery-core,jquery-migrate,utils,jquery-ui-core,jquery-ui-widget,jquery…:2 Uncaught SecurityError: Failed to read the 'contentDocument' property from 'HTMLIFrameElement': Sandbox access violation: Blocked a frame at "https://beta.com" from accessing a frame at "null".  The frame being accessed is sandboxed and lacks the "allow-same-origin" flag.

Any ideas?

In the core files of wordpress functions.php I can see

 * Send a HTTP header to limit rendering of pages to same origin iframes.
 *
 * @since 3.1.3
 *
 * @see https://developer.mozilla.org/en/the_x-frame-options_response_header
 */
function send_frame_options_header() {
    @header( 'X-Frame-Options: SAMEORIGIN' );
}

But I guess that's not the problem since other users would have mentioned it.

5
  • Wordpress might be setting it. Look for the string X-Frame-Options in your wordpress and plugins install. Sep 7, 2016 at 17:42
  • there is a mentioning in functions.php but i don't think that's the issue
    – JoaMika
    Sep 7, 2016 at 19:01
  • looks similar: wordpress.org/support/topic/… Sep 7, 2016 at 19:06
  • you are god! that was added by let's encrypt - fixed now :) how can i give you credit !
    – JoaMika
    Sep 7, 2016 at 19:12
  • happy to help, will copy that answer below in case it disappears from wordpress.org. Sep 7, 2016 at 19:39

1 Answer 1

6

Similar problem was posted to:

https://wordpress.org/support/topic/multiple-x-frame-options-headers-with-conflicting-values-sameorigin-deny/

Answer copied here for future reference, from

https://wordpress.org/support/users/knnleow/

There is duplicate setting in two places for the same config.

I removed the duplicate entry in

/etc/nginx/site-available/default 

config file.

Updated my

/etc/nginx/snippets/ssl-dhparams.conf 

to:

#add_header X-Frame-Options DENY;
add_header X-Frame-Options SAMEORIGIN;

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .