> For the complete documentation index, see [llms.txt](https://docs.uxwizz.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.uxwizz.com/guides/troubleshooting/dashboard/website-iframe-not-loading-x-frame-options.md).

# Website iframe not loading (x-frame-options)

### Problem:

A tracked page does not appear in a live-page heatmap or basic session replay. The browser may report `X-Frame-Options`, `frame-ancestors`, or mixed-content errors.

### Cause:

The tracked website can restrict which sites may display it in an iframe. An HTTPS dashboard can also be blocked from embedding an HTTP page.

This does not explain every blank replay. Full session recordings use recorded page content, while basic recordings and **Live page** heatmaps depend on the current website.

### Solutions:

1. In **Heatmaps**, try **Auto** or **Recorded snapshot** when a compatible snapshot is available. This can avoid loading the current website.
2. Check that both the dashboard and tracked page use HTTPS.
3. Open the browser console and identify the blocked URL and exact policy.
4. If the tracked page's policy blocks framing, ask its administrator to allow your dashboard's exact origin.

The first step is available in UXWizz. Changes to HTTP headers require access to the tracked website, its hosting panel, or its proxy/CDN configuration.

A scoped `frame-ancestors` directive can allow your own site and your dashboard:

```
frame-ancestors 'self' https://analytics.example.com;
```

Replace the example origin with your dashboard's scheme, hostname, and port if nonstandard. Preserve the other directives in the website's Content Security Policy. Do not replace a complete policy with this one directive or add a second conflicting policy.

### Apache:

Have the administrator update the existing `Content-Security-Policy` response header in the tracked site's virtual host or permitted `.htaccess` configuration. The `frame-ancestors` value must include your dashboard origin.

Check whether the application, Apache, or a proxy already sets the header. Do not enable `AllowOverride All` across the server to solve one site's header problem.

If the tracked site has **no existing CSP**, this Apache example creates a policy that permits framing by your dashboard:

```apache
Header always set Content-Security-Policy "frame-ancestors 'self' https://stats.example.com;"
```

This requires `mod_headers` and, when used in `.htaccess`, permission to use `Header` directives. On Ubuntu, `sudo a2enmod headers` enables the module. Test with `sudo apache2ctl configtest` before reloading Apache.

If a CSP already exists, edit that existing header instead. For example, keep `default-src 'self';` and other directives, changing only `frame-ancestors 'self';` to `frame-ancestors 'self' https://stats.example.com;`.

### Nginx:

Update the tracked site's existing CSP header at the configuration layer that owns it. Keep its other directives and ensure the final response includes the intended policy.

Validate the Nginx configuration before reloading it. A dashboard setting cannot change the tracked site's Nginx headers.

For a site with **no existing CSP**, add this in the relevant server/location configuration:

```nginx
add_header Content-Security-Policy "frame-ancestors 'self' https://stats.example.com;" always;
```

If the site already sends CSP, change its existing `frame-ancestors` directive instead. Check NGINX header inheritance: a location with its own `add_header` directives can behave differently from the surrounding server block. Run `sudo nginx -t` before `sudo systemctl reload nginx`.

### IIS (.NET):

Update the tracked site's existing CSP response header in IIS or the application configuration. Preserve the other directives and check for duplicate headers from upstream middleware or a CDN.

For a site with **no existing CSP**, add this entry under `system.webServer/httpProtocol/customHeaders` in its `web.config`:

```xml
<add name="Content-Security-Policy" value="frame-ancestors 'self' https://stats.example.com;" />
```

Replace `https://stats.example.com` in each example with your dashboard origin. If the header already exists, edit its value rather than adding a duplicate. Check the final response in your browser's **Network** panel after applying the change.

### Still not working?

* Inspect the final page response after redirects. A login page or another hostname can send a different policy.
* Check every enforced CSP header. Adding a more permissive header does not override an existing restrictive policy.
* If there are nested frames, each ancestor must be allowed.
* `frame-ancestors` must be an HTTP response header; a `<meta>` tag does not apply it.
* Check `X-Frame-Options` at the same time. Current browsers use an enforced `frame-ancestors` directive in preference to it; older browser behavior can differ.
* If the page loads but the heatmap does not become ready, check that the UXWizz tracker is installed and that its requests are not blocked. See [No data is being recorded](/guides/troubleshooting/tracking/no-data-is-being-recorded.md).

#### Advanced: temporary browser workaround

If you cannot change the tracked site's headers, a browser extension that ignores frame-blocking headers can sometimes let you inspect it locally. This is a last resort for a site you own or have permission to inspect.

{% hint style="warning" %}
Ignoring these headers weakens protection against clickjacking. Use a separate browser profile for this task, with no unrelated accounts signed in. Prefer an extension that can limit access to the affected site. Do not enable it for all websites or disable browser security globally.
{% endhint %}

1. Create a separate browser profile and open only the UXWizz dashboard and the affected site.
2. Check the extension's publisher, requested permissions, and supported headers before installing it. If it cannot limit its scope, keep that profile only for this test.
3. Enable the extension for the affected site, reload the page, and check the result.
4. Disable or remove the extension when finished.

This changes only your browser. It does not repair the site's headers for other users and may not resolve CSP, mixed content, missing trackers, or authentication problems. Avoid sensitive actions in the framed page. A recorded snapshot or a scoped server-header change remains the preferred solution.

### Useful resources:

* [MDN: CSP frame-ancestors](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-ancestors)
* [MDN: X-Frame-Options](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options)