I have an iframe on http://foo.example.com which targets to http://bar.example.com.
On http://bar.example.com is a WordPress installation. I’m able to view the page and click on all pages and post but when I try to go to the backend I get
Refused to display document because display forbidden by X-Frame-Options.
and the request is aborted.
According to this question I aded this header which gets send successfully:
header('X-Frame-Options: GOFORIT');
What else can limit the access to just the dashboard (and the login screen)?
I have access to both subdomains and can use a htaccess as well
Here is a better solution that won’t break when you update WordPress:
Here’s another solution if you’re using Apache. Throw this in your .htaccess:
According to this, in WordPress Answers, Receiving âThis content cannot be displayed in a frameâ error on login page, WordPress sends a special header
that prevents clickjacking. And hence, embedding the admin as an iframe.
It is possible to eliminate this header removing a couple of actions from
wp-includes/default-filters.php
, but at your own risk.Please, read the full Q&A at WPSE.