SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to show some content from Sharepoint in IFRAME. From some research, I come to know that specific setting for X-FRAME-OPTIONS in HTTP Header prevents rendering in iframes. How can I use ALLOW-FROM option of X-FRAME-OPTIONS to allow this? Given, I am admin for the Sharepoint Server 2013.

share|improve this question

1.Since you are admin , the iframe options are setup in the IIS and its mainly done to avoid Frameable clicking jacking attacks.

2.Page Level : I recommend you goto the specific html page with iframe and add a meta tag eg meta name=”X-FRAME-OPTIONS” content=”ALLOW-FROM” />

If the value contains the token ALLOW-FROM origin, the browser will block rendering only if the origin of the top-level browsing context is different than the origin value supplied with the Allow-From directive. For instance, if contains the X-FRAME-OPTIONS directive with the value Allow-From, then the page may be framed only by pages from the origin.

3.IIS setting : The below mentioned details will ensure your entire site is configured with the X-Frame-Options specified above and all the pages in your site would be affected.

To configure IIS to add an X-Frame-Options header to all responses for a given site, follow these steps: 1. Open Internet Information Services (IIS) Manager. 2. In the Connections pane on the left side, expand the Sites folder and select the site that you want to protect. 3. Double-click the HTTP Response Headers icon in the feature list in the middle. 4. In the Actions pane on the right side, click Add. 5. In the dialog box that appears, type X-Frame-Options in the Name field and type SAMEORIGIN in the Value field. 6. Click OK to save your changes.

The "ALLOW-FROM" is generally not supported by most of the broswers. Refer:

share|improve this answer
iframe options aren't set in IIS, they're set in the SharePoint HttpModule, you can't do anything specifically in IIS to switch it off. – James Love Sep 8 '14 at 8:55

You can add the tag in your master page so it becomes global for all pages

share|improve this answer
Can you please add more information regarding how to do that. It will help to make your answer more helpful :) – Robert Lindgren Oct 2 '13 at 7:02
  1. You can use option ALLOW-FROM of X-FRAME-OPTIONS (I have not tested this). Beware that this is not supported by all the browsers.
  2. Add to your master page the following code

    <%@ Register Tagprefix="WebPartPages" Namespace="Microsoft.SharePoint.WebPartPages" Assembly="Microsoft.SharePoint, Version=, Culture=neutral, PublicKeyToken=71e9bce111e9429c" %>
    <WebPartPages:AllowFraming runat="server"/>

    Pay attention because it only works with ASPX pages.

  3. Use the URL Rewrite IIS extension to remove the X-Frame-Options. You should check the origin of the request and remove the X-Frame-Options from the response. To do this, install the extension, go to the URL Rewrite config, add a new variable called RESPONSE_X-FRAME-OPTIONS and then you should define a new blank rule rewriting the value of X-FRAME-OPTIONS with an empty string.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.