We have 2 domain. and set into magento 2.2 as

Front-Domain : abcxyz.com

Admin-Domain : test.com

Admin section called one iframe from front-end.

Means: on admin call URL of the iframe is


Getting Error is on a console.

Refused to display 'abcxyz.com/productid/ID' in a frame because it set 'X-Frame-Options' to 'sameorigin'.

Can you please help me how to solve it.

1 Answer 1


You have to change the X-Frame-Options setting in app/etc/env.php

in your case it should be :

'x-frame-options' => 'ALLOW-FROM test.com',

Instead of :

'x-frame-options' => 'SAMEORIGIN',

source :


  • 'x-frame-options' => 'ALLOW-FROM test.com', I have used this but now this(test.com) website open for all website. and localhost too. this is not secure for me. Commented Aug 20, 2018 at 12:32
  • You should be clearer on what you want, if you don't want that test.com is open to the whole website then maybe you should re-configure your webserver to suit your needs. But keep in mind that Magento advertise against loading the store in a frame For security reasons, Magento strongly recommends against running the Magento storefront in a frame. Commented Aug 21, 2018 at 19:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.