Nothing will unset X-Frame-Options (Apache, PHP 5.3)

php apache x-frame-options
Corey picture Corey · Oct 16, 2015 · Viewed 16.3k times · Source

I'm trying to implement an embeddable widget, functioning similar to a Twitter embedded tweet. The simplest solution, though maybe not the best, appears to be an iframe or HTML5 embed - but both are being blocked by the X-Frame-Options header on the server.

I'm running PHP 5.3 and Apache 2.2 on a dedicated server under my full control.

I've tried placing on the first line of the very first line of the iframe PHP file:

header_remove("X-Frame-Options");

I've tried adding the following to .htaccess:

Header unset X-Frame-Options

I've checked httpd.conf, the vhost .conf file, even PHP.INI, and searched for "x-frame" - nothing apparently relevant in either.

No mod_security or other plugins that should be injecting this on this server that I see.

Yet curl verifies the following HTTP header no matter what I do:

X-Frame-Options: DENY

Is there some, maybe oddly named setting somewhere that could still be forcing this header in?

Answer

Corey picture Corey · Oct 16, 2015

X-Frame-Options was forced in by ssl.conf.

Commenting out and restarting Apache allowed .htaccess and PHP header management to work again.

Related questions

PHP code is not being executed, instead code shows on the page

I'm trying to execute some PHP code on a project (using Dreamweaver) but the code isn't being run. When I check the source code, the PHP code appears as HTML tags (I can see it in the source code). Apache …

Read More
Apache is not running from XAMPP Control Panel ( Error: Apache shutdown unexpectedly. This may be due to a blocked port)

I have installed XAMPP (xampp-win32-1.8.2-0-VC9-installer.exe) on Windows 7 successfully. But unfortunately, the following error was found during running Apache from XAMPP Control Panel: 5:38:38 PM [Apache] Error: Apache shutdown unexpectedly. 5:38:38 PM [Apache] This may be due to …

Read More
What is the difference between HTTP_HOST and SERVER_NAME in PHP?

What is the difference between HTTP_HOST and SERVER_NAME in PHP? where: HTTP_HOST === $_SERVER['HTTP_HOST'] SERVER_NAME === $_SERVER['SERVER_NAME'] When would you consider using one over the other and why?

Read More