Allow Your Site to Be Embedded Only on Partner Domains
Replaces the usual same-site framing rule with a Content-Security-Policy frame-ancestors list, so your pages can be shown in iframes on the partner sites you name and nowhere else.
Opens WPIDE on
Code
// Sites allowed to show your pages in an iframe.
$wpide_frame_partners = array( 'https://partner.example.com', 'https://*.example.org' );
add_action( 'send_headers', function () use ( $wpide_frame_partners ) {
if ( headers_sent() ) {
return;
}
header_remove( 'X-Frame-Options' );
$sources = array_map( function ( $source ) {
return preg_replace( '#[^a-z0-9.*:/-]#i', '', $source );
}, $wpide_frame_partners );
header( "Content-Security-Policy: frame-ancestors 'self' " . implode( ' ', $sources ), false );
}, 99 );Notes
This removes any X-Frame-Options header sent by WordPress or other snippets, since that header cannot list several sites.
How to add this snippet
- Install WPIDE on your WordPress site (it is free) and open Code Snippets.
- Use snippet above adds it from the library in one click. Or copy the code into a new snippet with the same code type.
- It is added inactive: review the code and settings, then switch it on.