Not able to embed iframe from different domain





I have a chatbot which I need to embed in on my page using iframe. The chatbot is hosted on a different domain. Whenever I embed it using iframe, I am getting error : "Refused to display ... in a frame because it set 'X-Frame-Options' to 'deny'."


I tried setting X frame policy in Sling Main Servlet to Allow from this domain but it shows "'ALLOW-FROM' is not a recognized directive. The header will be ignored."


Any suggestions on how I can achieve this?


Thanks in advance

Accepted Solutions (1)

Accepted Solutions (1)




Hello there,

It seems like it may be a problem with the chat bot itself. Check the response headers for:

  • Content Security Policy (CSP) frame-ancestors directive
  • X-Frame-Options 

Do they allow the use for iframe for consumption?

AEM pages should be able to display iframes without much configuration, but from experience, it’s not a good practice to use iframes on your webpages because ow security issues. 
You can start with a simple <iframe> that refers to to validate that no AEM configuration is required.

Answers (0)