I have a problem when I tried to import products with a CSV. The loading gif stay spinning and nothing happens. The page don´t show any error. I first thought that could be permissions problem, but I changed all permissions to 777 and the error persists.

Now in Chrome Console and Firebug, I see the next error:

Refused to display 'http://[site]/admin/admin/import/validate/key/bda6ac49ba7066862dd8fe30ca58ded2bffa852bd62c2e7cd43c6971dcf2bcaf/?form_key=xarU1fpOx0MQZPfT' in a frame because it set multiple 'X-Frame-Options' headers with conflicting values ('DENY, SAMEORIGIN'). Falling back to 'deny'.
POST http://[site]/admin/admin/import/validate/key/bda6ac49ba7066862dd8fe30ca58ded2bffa852bd62c2e7cd43c6971dcf2bcaf/?form_key=xarU1fpOx0MQZPfT net::ERR_BLOCKED_BY_RESPONSE

In some pages said that it could be by the x-frame-options value defined in app/etc/env.php. My current value is SAMEORIGIN:

'x-frame-options' => 'SAMEORIGIN',

What value it must be?


EDIT 1: ADDITIONAL INFORMATION Reviewing the headers of the request of my site, I saw that in every page, nos only Admin, the header X-Frame-Options is duplicated with different values:


What could make this happens?

2 Answers 2


Well, after so much research in code and configuration, I determined that the second header X-Frame-Options:DENY was nos declared in Magento. So, I review my others Magento and no Magento sites, and I noticed that every sites had the same header. So, the logical option was Apache.

I made a grep in Apache2 configurations, and I found a Header always set X-Frame-Options DENY in /etc/apache2/conf-available/ssl-params.conf I commented that line, restarted Apache, and surprise, the imports works fine, and I only see one X-Frame-Options header in the requests.

I don´t know if is a good practice comment that line. Someone with more expertise in that area could tell me more about. But, until that, this fix my problem. So, if someone is fighting with something similar, I recommend you look in the configuration of the server, to see if there is something that is inserting again the same header, additional to that of Magento.

  • 1
    This was a problem for me too, in Wordpress. You are a life saver, I'm leaving this comment so that google indexes it and helps save someone else.
    – undefined
    Commented Nov 29, 2017 at 14:26
  • 1
    Thank you! I'd used the below link to setup a local SSL, which included the X-Frame DENY config. digitalocean.com/community/tutorials/…
    – J. LaRosee
    Commented Sep 20, 2018 at 20:48
  • Finally I found the answer for my question, works like a charm. Thanks.
    – S1awek
    Commented Dec 2, 2019 at 13:29

@eliacim-davila-censere's answer works fine. I think its more secure to set this value to SAMEORIGIN so that iframes only from same domain can work.

In /etc/apache2/conf-available/ssl-params.conf change

Header always set X-Frame-Options DENY


Header always set X-Frame-Options SAMEORIGIN

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.