# Embedded comments not displayed due to X-Frame-Options DENY

**URL:** <https://meta.discourse.org/t/embedded-comments-not-displayed-due-to-x-frame-options-deny/47365>\
**Category:** Support\
**Created:** [15 Luglio 2016, 4:51pm UTC](https://meta.discourse.org/t/embedded-comments-not-displayed-due-to-x-frame-options-deny/47365 "2016-07-15T16:51:33Z")\
**Posts on this page:** 1\
**Showing post:** 12

<div class="post-metadata">

**Author:** ![guiniol](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/guiniol/32/107449_2.png) [@guiniol](https://meta.discourse.org/u/guiniol)\
**Post date:** [18 Luglio 2016, 9:27pm UTC](https://meta.discourse.org/t/embedded-comments-not-displayed-due-to-x-frame-options-deny/47365/12 "2016-07-18T21:27:15Z")

</div>

In case someone stumbles upon this thread and wants `X-Frame-Options DENY` as defaults but still wants to embed comments, here is the solution direct from #nginx (apparently `if`s should be avoided where possible:

outside of the `server` clause:

```plaintext
map $arg_embed_url $xfo {
        default DENY;
        ~^https%3A%2F%2Favril4th.com%2F.* "ALLOW-FROM https://avril4th.com/";
}

```

and then inside the `location` where you want to allow embeding:

```plaintext
add_header X-Frame-Options $xfo;

```

---

_[View the full topic](https://meta.discourse.org/t/embedded-comments-not-displayed-due-to-x-frame-options-deny/47365)._