# X-Frame Origin Embed Error

**URL:** https://meta.discourse.org/t/x-frame-origin-embed-error/35344
**Category:** Support
**Created:** [November 7, 2015, 8:51pm UTC](https://meta.discourse.org/t/x-frame-origin-embed-error/35344 "2015-11-07T20:51:09Z")
**Posts on this page:** 15
**Page:** 1

<div class="post-metadata">

### Author: ![davidbalderston](https://avatars.discourse-cdn.com/v4/letter/d/df788c/32.png) [@davidbalderston](https://meta.discourse.org/u/davidbalderston)
#### Post date: [November 7, 2015, 8:51pm UTC](https://meta.discourse.org/t/x-frame-origin-embed-error/35344/1 "2015-11-07T20:51:09Z")

</div>

Sorry, I know there have been other topics about this, but I cannot seem to get it figured out at this point. I have a fresh install of discourse on DigitalOcean using the App, and a Ghost blog. I have the allowed host as the root of my website, and have pasted the code into Ghost, but constantly get the `"Refused to display 'http://community.howtoghost.com/embed/comments?embed_url=https%3A%2F%2Fwww.ghostforbeginners.com%2Fhosting-and-installing-ghost%2F' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'."` error.

 ![](https://global.discourse-cdn.com/meta/original/3X/0/0/0060fa59af68e09fd93cf50284ad00db15a48103.png)

From what it looks like, since I have the host in discourse, this shouldn’t be a problem, but after a few days of trying, I cannot get it to work. Have tried both `www.site.com` and just `site.com`, neither work. Does anyone have any ideas? I would really appreciate the help.

Actual Embedded Ghost Code:

```plaintext
<div id='discourse-comments'></div>

<script type="text/javascript">
  DiscourseEmbed = { discourseUrl: 'http://community.howtoghost.com/',
     discourseEmbedUrl: 'https://www.ghostforbeginners.com' + {{url}} };

   (function() {
    var d = document.createElement('script'); d.type = 'text/javascript'; d.async = true;
    d.src = DiscourseEmbed.discourseUrl + 'javascripts/embed.js';
    (document.getElementsByTagName('head')[0] || document.getElementsByTagName('body')[0]).appendChild(d);
  })();
</script>

```

Thanks,  
David B

---

<div class="post-metadata">

### Author: ![riking](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/riking/32/170938_2.png) [@riking](https://meta.discourse.org/u/riking)
#### Post date: [November 9, 2015, 10:55pm UTC](https://meta.discourse.org/t/x-frame-origin-embed-error/35344/2 "2015-11-09T22:55:20Z")

</div>

Fill out the “cors origins” site setting with `www.ghostforbeginners.com` and restart the server `./launcher restart app`.

---

<div class="post-metadata">

### Author: ![davidbalderston](https://avatars.discourse-cdn.com/v4/letter/d/df788c/32.png) [@davidbalderston](https://meta.discourse.org/u/davidbalderston)
#### Post date: [November 10, 2015, 5:40am UTC](https://meta.discourse.org/t/x-frame-origin-embed-error/35344/3 "2015-11-10T05:40:35Z")

</div>

Thank you for the reply riking. Do you make these changes in the `app.yml`? In the `app.yml` I have tried:

```
DISCOURSE_ENABLE_CORS: true
DISCOURSE_CORS_ORIGIN: '*'

```

and

```
DISCOURSE_ENABLE_CORS: true
DISCOURSE_CORS_ORIGIN: 'www.ghostforbeginners.com'

```

and

```
DISCOURSE_ENABLE_CORS: true
DISCOURSE_CORS_ORIGIN: 'www.ghostforbeginners.com*'

```

and a few others like including https and what not.

None of which change the outcome. Still get the same x-frame problem. I tried adding them under the `env:` section, and also near the bottom with no change.

---

<div class="post-metadata">

### Author: ![riking](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/riking/32/170938_2.png) [@riking](https://meta.discourse.org/u/riking)
#### Post date: [November 10, 2015, 7:29am UTC](https://meta.discourse.org/t/x-frame-origin-embed-error/35344/4 "2015-11-10T07:29:21Z")

</div>

Well, that should have worked as well.

---

<div class="post-metadata">

### Author: ![davidbalderston](https://avatars.discourse-cdn.com/v4/letter/d/df788c/32.png) [@davidbalderston](https://meta.discourse.org/u/davidbalderston)
#### Post date: [November 13, 2015, 2:20am UTC](https://meta.discourse.org/t/x-frame-origin-embed-error/35344/5 "2015-11-13T02:20:46Z")

</div>

Any other ideas by chance? It seems like Discourse is restarting, but is it possible it isn’t taking the configs for whatever reason?

---

<div class="post-metadata">

### Author: ![dubeydeepak](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/dubeydeepak/32/70085_2.png) [@dubeydeepak](https://meta.discourse.org/u/dubeydeepak)
#### Post date: [March 31, 2017, 5:47am UTC](https://meta.discourse.org/t/x-frame-origin-embed-error/35344/6 "2017-03-31T05:47:13Z")

</div>

Hi I Tried multiple option by adding into app.yml. But its not working. Still throwing error "

**Refused to display ‘[http://162.188.21.09:8080/](http://162.188.21.09:8080/)’ in a frame because it set ‘X-Frame-Options’ to ‘SAMEORIGIN’.**  
"

Actually I’m trying to render ‘[http://162.188.21.09:8080/](http://162.188.21.09:8080/)’ in iframe local host.

**env:**  
\*\* DISCOURSE\_DB\_PASSWORD: ‘discourse’\*\*  
\*\* DISCOURSE\_ENABLE\_CORS: true\*\*  
\*\* DISCOURSE\_CORS\_ORIGIN: [http://162.188.21.09:8080/](http://162.188.21.09:8080/)'\*\*

How to fix it.?

---

<div class="post-metadata">

### Author: ![Mittineague](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mittineague/32/114259_2.png) [@Mittineague](https://meta.discourse.org/u/Mittineague)
#### Post date: [March 31, 2017, 6:05am UTC](https://meta.discourse.org/t/x-frame-origin-embed-error/35344/7 "2017-03-31T06:05:41Z")

</div>

> [@dubeydeepak](#):
>
> in iframe

I think you would be better off coming up with a different approach

> [@Discourse not shown in iframe](https://meta.discourse.org/t/discourse-not-shown-in-iframe/26970/4):
>
> We do not support running in an iframe.

> [@Support embedding Discourse in an iframe](https://meta.discourse.org/t/support-embedding-discourse-in-an-iframe/50405/7):
>
> Because it’s an extremely fragile configuration. Discourse expects to control the browser tightly as a JavaScript app. This is not a static 1996 era web page to be slapped in an \<iframe\> willy-nilly, it’s far more complex.

---

<div class="post-metadata">

### Author: ![Adi\_Adi](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/adi_adi/32/70081_2.png) [@Adi\_Adi](https://meta.discourse.org/u/Adi_Adi)
#### Post date: [March 31, 2017, 6:28am UTC](https://meta.discourse.org/t/x-frame-origin-embed-error/35344/8 "2017-03-31T06:28:21Z")

</div>

Can you tell us how to do it if we want to integrate it in my website ?

---

<div class="post-metadata">

### Author: ![Mittineague](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mittineague/32/114259_2.png) [@Mittineague](https://meta.discourse.org/u/Mittineague)
#### Post date: [March 31, 2017, 6:31am UTC](https://meta.discourse.org/t/x-frame-origin-embed-error/35344/9 "2017-03-31T06:31:25Z")

</div>

If I wanted to include Discourse content into a non-Discourse site I would use either the RSS or JSON or both.

---

<div class="post-metadata">

### Author: ![Adi\_Adi](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/adi_adi/32/70081_2.png) [@Adi\_Adi](https://meta.discourse.org/u/Adi_Adi)
#### Post date: [March 31, 2017, 6:39am UTC](https://meta.discourse.org/t/x-frame-origin-embed-error/35344/10 "2017-03-31T06:39:09Z")

</div>

Do you have any reference so I can get more info how to do it and to identify pros/cons for my requirement ?

---

<div class="post-metadata">

### Author: ![Adi\_Adi](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/adi_adi/32/70081_2.png) [@Adi\_Adi](https://meta.discourse.org/u/Adi_Adi)
#### Post date: [March 31, 2017, 6:39am UTC](https://meta.discourse.org/t/x-frame-origin-embed-error/35344/11 "2017-03-31T06:39:44Z")

</div>

Like demo or integration steps ?  
thnks

---

<div class="post-metadata">

### Author: ![dubeydeepak](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/dubeydeepak/32/70085_2.png) [@dubeydeepak](https://meta.discourse.org/u/dubeydeepak)
#### Post date: [March 31, 2017, 8:28am UTC](https://meta.discourse.org/t/x-frame-origin-embed-error/35344/12 "2017-03-31T08:28:06Z")

</div>

Hey Guys,  
Its working now, I forgot to rebuild the app.  
./launcher rebuild app.

---

<div class="post-metadata">

### Author: ![Julian\_Somoza](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@Julian\_Somoza](https://meta.discourse.org/u/Julian_Somoza)
#### Post date: [August 17, 2018, 1:44pm UTC](https://meta.discourse.org/t/x-frame-origin-embed-error/35344/13 "2018-08-17T13:44:17Z")

</div>

I solved it using this plugin…

> <https://github.com/somoza/discourse-xorigin/blob/master/plugin.rb>

---

<div class="post-metadata">

### Author: ![Det](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/det/32/139503_2.png) [@Det](https://meta.discourse.org/u/Det)
#### Post date: [June 10, 2019, 12:57pm UTC](https://meta.discourse.org/t/x-frame-origin-embed-error/35344/14 "2019-06-10T12:57:05Z")

</div>

Can you plese provide steps as to how to install and use the plugin.

---

<div class="post-metadata">

### Author: ![trusktr](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/trusktr/32/116841_2.png) [@trusktr](https://meta.discourse.org/u/trusktr)
#### Post date: [July 20, 2020, 5:33am UTC](https://meta.discourse.org/t/x-frame-origin-embed-error/35344/15 "2020-07-20T05:33:47Z")

</div>

@Det Here’s a guide on Discourse plugins: [How to create a Discourse plugin – kleinfreund.de](https://kleinfreund.de/how-to-create-a-discourse-plugin/#customization:plugin.rb)