Safari - Conflicting Multiple 'X-Frame-Options'


Having an issue with the following error when accessing the WP customiser:

[Error] Multiple ‘X-Frame-Options’ headers with conflicting values (‘ALLOW-FROM, SAMEORIGIN’) encountered when loading ‘’. Falling back to ‘DENY’.

[Error] Refused to display ‘’ in a frame because it set ‘X-Frame-Options’ to ‘ALLOW-FROM, SAMEORIGIN’.

Seems to only be an issue in Safari. Any way to fix this?

Using the latest Trellis, Bedrock and Sage 9. Deployed to Digital Ocean. Problem occurs on both localhost and the DO server.

What Safari version?

Latest I believe: Version 10.1.1 (12603.2.4)

Trellis only sets X-Frame-Options: SAMEORIGIN. Seems like Safari is complaining about that in combination with ALLOW-FROM.

Maybe your site, WP, or a plugin is adding ALLOW-FROM?

1 Like

It’s a standard out of the box brand new deployment with no theme/plugins so can only be settings from what Trellis or WP its self might set as default. Can’t say I’ve ever come across WP itself adding x-frame-options.

Doing a search of the entire project folder for X-Frame-Options: returns nothing.

Safari has this in the headers being sent: X-Frame-Options SAMEORIGIN, SAMEORIGIN

Chrome only has the one.

If I edit out the line include h5bp/directive-only/extra-security.conf; from my sites Nginx conf then it works fine in safari and is still getting the same origin being set in the headers so it must be being set somewhere else in Nginx as well as the included extra security file.


Only other place I can find it being set is by WordPress its self in functions.php.

Found this:

Exact same behaviour?

1 Like

Exactly the same :slight_smile:

Replying to endortrails:
NGINX with a single add_header X-Frame-Options SAMEORIGIN; set in configs.
So if you remove this Nginx rule, the Customizer loads as expected in Safari?
The resolution here may be that the Nginx config should be removed in favor of adding the X-Frame-Options header via PHP in WordPress only.

The above suggestion does fix it but again removes other things by commenting out that file that I’d rather have.