I’ve hit that rock too last evening. After some tests it showed up it’s caused by X-Frame-Option set to DENY (or not properly set ALLOW FROM, which I’d probably like to use).
Paul, try to change that setting to sameorigin
Other options like CPS seem not to affect UX Builder. It seems also not affecting recaptcha even f it’s in iframe too…
I hope Carl could explain me that.
I thought X-F-O is blocking external sources from iframes to be loaded. right?
However Vimeo and reCaptha both use iframes but are still working even with deny option, but UX Builder stops working while being set to DENY…
Am I missing something?
Thanks in advance and sorry if I ask wrong questions, I’m new to this area of security… ??