donlychan

Bad news, sudo grep -R "X-Frame-Options" /etc/nginx/ return only one result.

Hi, cromodder. Thank you for your reply.

Here is the console error by Safari.

Multiple 'X-Frame-Options' headers with conflicting values ('ALLOW-FROM https://host/wp-admin/customize.php, SAMEORIGIN') encountered when loading 'https://host/?customize_changeset_uuid=uuid&customize_theme=twentyseventeen&customize_messenger_channel=preview-0'. Falling back to 'DENY'.

Refused to display 'https://host/?customize_changeset_uuid=uuid&customize_theme=twentyseventeen&customize_messenger_channel=preview-0' in a frame because it set 'X-Frame-Options' to 'ALLOW-FROM https://host/wp-admin/customize.php, SAMEORIGIN'.

Hi, knnleow.

Could you give more details about the duplicate setting in /etc/nginx/site-available/default config file.

I updated the “/etc/nginx/snippets/ssl-params.conf” as follow,

#add_header X-Frame-Options DENY;
add_header X-Frame-Options SAMEORIGIN;

But it didn’t work for me, please help.

Thanks,
Don