X-Frame-Options Configuration
This module allows you to control how your website content can be embedded in iframes on other sites by setting the X-Frame-Options HTTP header. You can choose directives like DENY, SAMEORIGIN, or ALLOW-FROM a specific URI to prevent clickjacking attacks.
Synopsis
This module can be used to set the x-frame-options header on your website with the appropriate directive. This might be useful when you want to include one of the pages of your site inside an iframe in another site.
The directives must be:
1. DENY
2. SAMEORIGIN
3. ALLOW-FROM uri (Currently [2021-03-15] not accepted by Chrome, Safari, Opera). You will be allowed to configure which uri.
There is a new option in the module to not use the header: ALLOW ALL.
Notes:
The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a <frame>, <iframe> or <object> . Sites can use this to avoid clickjacking attacks, by ensuring that their content is not embedded into other sites.
More info regarding the x-frame-options response header here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options.
Installation
Install as you would normally install a contributed Drupal module. Visit: https://www.drupal.org/docs/8/extending-drupal-8/installing-drupal-8-mod... for further information.
composer require drupal/x_frame_options_configuration
Notice the module is x_frame_options_configuration not x_frame_options (as I had initially)
Enable the module with Drush:
drush en -y x_frame_options_configuration
Configuration
Go to Configuration » System » X-frame-options header (/admin/config/system/x_frame_options_configuration/settings) and select the directive you want to use and if asked type the uri you will allow to render your site from.