# Allow Your Site to Be Embedded Only on Partner Domains

> Replaces the usual same-site framing rule with a Content-Security-Policy frame-ancestors list, so your pages can be shown in iframes on the partner sites you name and nowhere else.

- Type: PHP
- Runs: Frontend only
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: headers, iframes, clickjacking
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/sec-frame-ancestors-allowlist/

## Code

```php
// Sites allowed to show your pages in an iframe.
$wpide_frame_partners = array( 'https://partner.example.com', 'https://*.example.org' );

add_action( 'send_headers', function () use ( $wpide_frame_partners ) {
    if ( headers_sent() ) {
        return;
    }

    header_remove( 'X-Frame-Options' );
    $sources = array_map( function ( $source ) {
        return preg_replace( '#[^a-z0-9.*:/-]#i', '', $source );
    }, $wpide_frame_partners );

    header( "Content-Security-Policy: frame-ancestors 'self' " . implode( ' ', $sources ), false );
}, 99 );
```

## Notes

This removes any X-Frame-Options header sent by WordPress or other snippets, since that header cannot list several sites.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Allow Your Site to Be Embedded Only on Partner Domains" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/