1

Using Wordpress on Nginx.

I am receiving these errors but I can't seem to find out where in my Nginx options I have specified this 'DENY' header.

Multiple 'X-Frame-Options' headers with conflicting values ('SAMEORIGIN, DENY') encountered when loading 'https://beta.com/wp-admin/plugin-install.php?tab=plugin-information&plugin=duplicate-post&'. Falling back to 'DENY'.

Refused to display 'https://beta.com/wp-admin/plugin-install.php?tab=plugin-information&plugin=duplicate-post&' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN, DENY'.

load-scripts.php?c=1&load[]=jquery-core,jquery-migrate,utils,jquery-ui-core,jquery-ui-widget,jquery…:2 Uncaught SecurityError: Failed to read the 'contentDocument' property from 'HTMLIFrameElement': Sandbox access violation: Blocked a frame at "https://beta.com" from accessing a frame at "null".  The frame being accessed is sandboxed and lacks the "allow-same-origin" flag.

Any ideas?

In the core files of wordpress functions.php I can see

 * Send a HTTP header to limit rendering of pages to same origin iframes.
 *
 * @since 3.1.3
 *
 * @see https://developer.mozilla.org/en/the_x-frame-options_response_header
 */
function send_frame_options_header() {
    @header( 'X-Frame-Options: SAMEORIGIN' );
}

But I guess that's not the problem since other users would have mentioned it.

5
  • Wordpress might be setting it. Look for the string X-Frame-Options in your wordpress and plugins install. Sep 7, 2016 at 17:42
  • there is a mentioning in functions.php but i don't think that's the issue
    – JoaMika
    Sep 7, 2016 at 19:01
  • looks similar: wordpress.org/support/topic/… Sep 7, 2016 at 19:06
  • you are god! that was added by let's encrypt - fixed now :) how can i give you credit !
    – JoaMika
    Sep 7, 2016 at 19:12
  • happy to help, will copy that answer below in case it disappears from wordpress.org. Sep 7, 2016 at 19:39

1 Answer 1

6

Similar problem was posted to:

https://wordpress.org/support/topic/multiple-x-frame-options-headers-with-conflicting-values-sameorigin-deny/

Answer copied here for future reference, from

https://wordpress.org/support/users/knnleow/

There is duplicate setting in two places for the same config.

I removed the duplicate entry in

/etc/nginx/site-available/default 

config file.

Updated my

/etc/nginx/snippets/ssl-dhparams.conf 

to:

#add_header X-Frame-Options DENY;
add_header X-Frame-Options SAMEORIGIN;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.