1

Using Wordpress on Nginx.

I am receiving these errors but I can't seem to find out where in my Nginx options I have specified this 'DENY' header.

Multiple 'X-Frame-Options' headers with conflicting values ('SAMEORIGIN, DENY') encountered when loading 'https://beta.com/wp-admin/plugin-install.php?tab=plugin-information&plugin=duplicate-post&'. Falling back to 'DENY'.

Refused to display 'https://beta.com/wp-admin/plugin-install.php?tab=plugin-information&plugin=duplicate-post&' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN, DENY'.

load-scripts.php?c=1&load[]=jquery-core,jquery-migrate,utils,jquery-ui-core,jquery-ui-widget,jquery…:2 Uncaught SecurityError: Failed to read the 'contentDocument' property from 'HTMLIFrameElement': Sandbox access violation: Blocked a frame at "https://beta.com" from accessing a frame at "null".  The frame being accessed is sandboxed and lacks the "allow-same-origin" flag.

Any ideas?

In the core files of wordpress functions.php I can see

 * Send a HTTP header to limit rendering of pages to same origin iframes.
 *
 * @since 3.1.3
 *
 * @see https://developer.mozilla.org/en/the_x-frame-options_response_header
 */
function send_frame_options_header() {
    @header( 'X-Frame-Options: SAMEORIGIN' );
}

But I guess that's not the problem since other users would have mentioned it.

  • Wordpress might be setting it. Look for the string X-Frame-Options in your wordpress and plugins install. – Jonah Benton Sep 7 '16 at 17:42
  • there is a mentioning in functions.php but i don't think that's the issue – Joanna Mikalai Sep 7 '16 at 19:01
  • looks similar: wordpress.org/support/topic/… – Jonah Benton Sep 7 '16 at 19:06
  • you are god! that was added by let's encrypt - fixed now :) how can i give you credit ! – Joanna Mikalai Sep 7 '16 at 19:12
  • happy to help, will copy that answer below in case it disappears from wordpress.org. – Jonah Benton Sep 7 '16 at 19:39
5

Similar problem was posted to:

https://wordpress.org/support/topic/multiple-x-frame-options-headers-with-conflicting-values-sameorigin-deny/

Answer copied here for future reference, from

https://wordpress.org/support/users/knnleow/

There is duplicate setting in two places for the same config.

I removed the duplicate entry in

/etc/nginx/site-available/default 

config file.

Updated my

/etc/nginx/snippets/ssl-dhparams.conf 

to:

#add_header X-Frame-Options DENY;
add_header X-Frame-Options SAMEORIGIN;
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.