# CSP Frame Ancestors enabled by default

**URL:** https://meta.discourse.org/t/csp-frame-ancestors-enabled-by-default/197615
**Category:** Announcements
**Created:** [July 19, 2021, 7:11pm UTC](https://meta.discourse.org/t/csp-frame-ancestors-enabled-by-default/197615 "2021-07-19T19:11:53Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [July 19, 2021, 7:11pm UTC](https://meta.discourse.org/t/csp-frame-ancestors-enabled-by-default/197615/1 "2021-07-19T19:11:53Z")

</div>

We just enabled the [Content-Security-Policy (CSP) frame-ancestors directive](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors) by default on Discourse.

By default it allows `self` and any domains allowed in Admin \> Customize \> Embedding.

If necessary, a site administrator may disable it using the site setting `content security policy frame ancestors`, but that is **not** recommended.

---

<div class="post-metadata">

### Author: ![alxndr](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/alxndr/32/102300_2.png) [@alxndr](https://meta.discourse.org/u/alxndr)
#### Post date: [August 4, 2021, 3:38pm UTC](https://meta.discourse.org/t/csp-frame-ancestors-enabled-by-default/197615/2 "2021-08-04T15:38:09Z")

</div>

Can this be configured to allow an iframe on a site running at `localhost`?

---

<div class="post-metadata">

### Author: ![Falco](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/falco/32/179432_2.png) [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [August 4, 2021, 3:43pm UTC](https://meta.discourse.org/t/csp-frame-ancestors-enabled-by-default/197615/3 "2021-08-04T15:43:02Z")

</div>

It may work by adding that in the

> [@Falco](#):
>
> Admin \> Customize \> Embedding.

section. But since it’s for local development you can also disable CSP on your dev browser, which would get the same result.

---

<div class="post-metadata">

### Author: ![alxndr](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/alxndr/32/102300_2.png) [@alxndr](https://meta.discourse.org/u/alxndr)
#### Post date: [August 5, 2021, 6:52pm UTC](https://meta.discourse.org/t/csp-frame-ancestors-enabled-by-default/197615/4 "2021-08-05T18:52:40Z")

</div>

I tried adding `localhost`, both with and without the port, but no dice… I’ll look into disabling it in the browser. Thanks!

---

<div class="post-metadata">

### Author: ![JammyDodger](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jammydodger/32/254611_2.png) [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [December 20, 2023, 11:15am UTC](https://meta.discourse.org/t/csp-frame-ancestors-enabled-by-default/197615/5 "2023-12-20T11:15:01Z")

</div>