We have a site running in HTTPS and are configuring XPM. We've enabled Tridion CM to run HTTPS as well following the docs on SDL Live (http://sdllivecontent.sdl.com/LiveContent/content/en-US/SDL_Tridion_2011_SPONE/task_FC687109502D4F29BBC8E7222A9C117A). We are now getting the following error when clicking the Tridion Site Edit button from the top left of the website page:

Load denied by X-Frame-Options: https://mydomain.mysite.com/blah/blah.jsp does not permit cross-origin framing.

enter image description here

What does this mean?

2 Answers 2


It is important to know that XPM actually loads yout website in an iFrame. So if you have set your HTTP headers to disallow this, then the error occurs.

This answer helped: https://stackoverflow.com/a/10174077

We use IPlanet, so on the web server we removed the HTTP header restriction to disallow embedding our site into an iframe. This did the trick.


In case you are not able to configure the Web Server to drop the header, a Chrome extension will do the trick as well:

Source: https://gist.github.com/dergachev/e216b25d9a144914eae2

Chrome Store: https://chrome.google.com/webstore/detail/ignore-x-frame-headers/gleekbfjekiniecknbkamfmkohkpodhe

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.