Refused to display in a frame because an ancestor violates frame-ancestors / X-Frame-Options

An embed is blank, the console says the page “refused to display in a frame”, and your payment widget, docs iframe or admin preview is empty. The page is blocking being framed — usually on purpose.

What the error means

Browsers show one of these (wording varies slightly):

• Refused to display 'https://app.example/…' in a frame because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self'"
• Refused to display '…' in a frame because it set 'X-Frame-Options' to 'deny' (or 'sameorigin')

The check runs on the document inside the iframe. Your outer page is fine; the inner response's headers said “don't let this parent embed me.” That is clickjacking defence: without it, a hostile site could overlay invisible UI on top of your logged-in page and steal clicks.

DENY vs SAMEORIGIN vs frame-ancestors

When both XFO and frame-ancestors are present, modern browsers obey frame-ancestors and ignore XFO for framing. default-src never covers frame-ancestors — you must set it yourself. Paste your headers into the X-Frame-Options & frame-ancestors explainer to see the effective rule and try attacker origins. From a script or CI job, the free Anvil framing / clickjacking API returns the same grade and check as JSON.

Allow a trusted parent

# Prefer CSP (overrides XFO when both are sent)
Content-Security-Policy: frame-ancestors 'self' https://trusted.example https://*.partner.example;

# nginx
add_header Content-Security-Policy "frame-ancestors 'self' https://trusted.example" always;

# Express
res.setHeader("Content-Security-Policy", "frame-ancestors 'self' https://trusted.example");

List every parent that must embed you, including preview domains and local dev (http://localhost:3000) if needed. Wildcards cover one DNS label (*.partner.example matches a.partner.example, not partner.example itself). After changing headers, hard-refresh; CDNs and service workers can cache the old policy.

How to harden (when you are the framed site)

• Sensitive pages (login, checkout, account settings): frame-ancestors 'none' or X-Frame-Options: DENY.
• Same-site embeds only: frame-ancestors 'self'.
• Never rely on ALLOW-FROM alone.
• Send framing policy as an HTTP header, not a meta tag.
• Combine with cookie SameSite (see the Set-Cookie explainer) — framing defence and cookie rules solve different attacks.

Related

Refused to execute inline script (CSP) · CSP header explainer · CSRF token missing · CORS errors · CSP Report-Only vs Enforce · Wirebook bots lesson · NotAllowedError getUserMedia (iframe allow)

Questions

Published 5 November 2026.