Embedding CiviCRM Event form in an Iframe
Drupal core is now protected against clickjacking by default:
https://www.drupal.org/node/2735873

You can install Security Kit module -> and then add specific allow-from domains.