@anthonychan2509 (Anthony C.) posted a new topic, subject "How to allow iframe a Webflow website while keeping "Use Secure Frame Headers" switched on?". It read:

   I would like to keep “Use Secure Frame Headers” switched on in the setting, but would also need to iframe some pages of the site that connects to the same domain but different sub-domain.
    
    For example:
    
    The page needs to be embedded (Webflow websites):  
    `app.domain.com/page/policy`
    
    The site that uses iframe to show the above page:  
    `lp.domain.com/legal`
    
    I tried putting this to head but not success:  
    `<meta http-equiv="Content-Security-Policy" content="default-src 'self' *.domain.com" />`
    
    Reference: Content-Security-Policy - HTTP | MDN
    
    Any idea? Thanks a lot.

After which, @webdev (Jeff S) added

    If the header policy is set and the meta as well, the browser will honor the most restrictive. Thus your problem.

@anthonychan2509 (Anthony C.) replied

    Thanks Jeff
    
    Contacted support. It will need Enterprise Plan to set up whitelist.
    
    Here's what they said:
    
    > “If you have this setting enabled, your site will not be able to be iframed by another site. If you needed to allow or whitelist certain domains, you would need to use custom security headers which are currently not available on self-serve hosting plans. This is an option if you're on one of our Enterprise Plans. If you think you may be interested in an Enterprise Plan for this feature, please do let us know and I can put you in contact with our Enterprise Team.”


{'source': 'discourse', 'url': 'https://discourse.webflow.com/t/how-to-allow-iframe-a-webflow-website-while-keeping-use-secure-frame-headers-switched-on/211989', 'title': 'How to allow iframe a Webflow website while keeping "Use Secure Frame Headers" switched on?', 'views': 132, 'has_accepted_answer': False, 'word_count': 232, 'like_count': 0, 'reply_count': 1, 'participant_count': 2, 'posts': 3, 'tags': '', 'author': '@anthonychan2509 (Anthony C.)', 'participants': '@anthonychan2509 (Anthony C.), @webdev (Jeff S)', 'image_url': [None], 'created_at': '2022-07-23T06:48:24.075Z', 'last_posted_at': '2022-07-24T06:06:08.909Z'}