iFrame got blocked after update WordPress 6.9

Pro-tip: Remove conflicting headers first

Starting from WordPress 6.x, the core might be more aggressive in sending the X-Frame-Options: SAMEORIGIN header, which often conflicts with frame-ancestors. When both are present, the browser will follow the most restrictive one.

To fix this, you should remove the default X-Frame-Options and use send_headers hook which is the dedicated way to handle this in WordPress.

Try this snippet in your functions.php:

add_action('send_headers', function() { // 1. Remove the default WordPress header to prevent conflicts header_remove('X-Frame-Options'); $app_domain = 'https://example.com'; // 2. Validate the referer or origin // Note: HTTP_REFERER can be unreliable. Checking the Origin is often safer. $referer = $_SERVER['HTTP_REFERER'] ?? ''; if (strpos($referer, $app_domain) !== false) { // Allow the specific subdomain/domain header("Content-Security-Policy: frame-ancestors 'self' " . $app_domain); } else { // Fallback to self only header("Content-Security-Policy: frame-ancestors 'self'"); } }, 1);