diff --git a/docs/widgets/iframe/index.mdx b/docs/widgets/iframe/index.mdx index 78783a00..5be26f3b 100644 --- a/docs/widgets/iframe/index.mdx +++ b/docs/widgets/iframe/index.mdx @@ -42,8 +42,24 @@ for security reasons, as users could easily be tricked by embeding the original site on a malicious page. Some proxies disallow iframes by default for this reason. -You can use https://iframetester.com/ to check, if the site is allowing iframes. -If you manage all of your own applications, you can usually change that. +You can use https://iframetest.com to check, if the site is allowing iframes. + +If you manage all of your own applications, you can usually change that by configuring +the appropriate headers (such as `X-Frame-Options` or `Content-Security-Policy`) to allow iframes. + +For example, to allow your site to be embedded in iframes from specific domains: + +**Apache (.htaccess or httpd.conf):** +```apache +Header set Content-Security-Policy "frame-ancestors 'self' https://trusted-domain.com" +Header set X-Frame-Options "ALLOW-FROM https://trusted-domain.com" +``` + +**Nginx:** +```nginx +add_header Content-Security-Policy "frame-ancestors 'self' https://trusted-domain.com"; +add_header X-Frame-Options "ALLOW-FROM https://trusted-domain.com"; +``` ### Example URLs