---
title: "Configuring iframe embedding"
date: "2026-08-12T11:05:11+00:00"
summary: "Learn how to configure iframe embedding in Source CMS—add trusted origins, apply CSP rules, and protect your site from clickjacking."
image:
type: "page"
url: "/source-cms/configuring-iframe-embedding"
id: "39cc9b01-745a-4fca-914c-f98fea3566fa"
---

The Iframe embedding feature enables trusted external websites to embed pages from your site. For example, add the origin of a trusted external website, such as a partner portal, to the permitted list to display your content. By default, Source CMS blocks other websites when they attempt to embed the pages of your site in an iframe. This default behavior protects your site against clickjacking attacks. Use this document to configure permitted origins, review the validation rules for these origins, and manage external access.

Prerequisites
-------------

Ensure that you meet the following prerequisites:

*   You must have the Administrator role.
*   Content Security Policy (CSP) headers must be enabled on your site.
    
    Note
    
    Source CMS enables CSP headers by default on all sites. If the form displays a warning that security headers are disabled and cannot save, contact Acquia Support to re-enable the CSP on your site.
    

Content Security Policy header updates
--------------------------------------

To enable external access, Source CMS applies the permitted origins to the frame-ancestors directive in the CSP header of the site. This header specifies the origins permitted to embed your site in an iframe, object, or embed element. The directive always includes `self` for your own site and any origins you add through the form. 

*    For example, after you add `https://www.example.com`, the header sent to browsers contains the following directive: 
    

    Content-Security-Policy: frame-ancestors 'self' https://www.example.com

Changes take effect immediately across your site after you save the configuration.

Validation rules
----------------

The form validates each entered origin:

Requirement

Valid example

Invalid example

Include the `https://` or `http://` scheme

`https://example.com`

`example.com`

Provide a valid hostname

`https://www.example.com`

`https://not valid.com`

Use the `*.` prefix for subdomain wildcards

`https://*.example.com`

`https://example.*`

Exclude paths, query strings, or fragments

`https://example.com`

`https://example.com/page`

Provide an optional port from 1 to 65535

`https://example.com:8080`

`https://example.com:0`

If an entry fails validation, the form displays an error and does not save the changes.

If an external site cannot embed your pages after you save a valid origin, do the following:

*   Ensure that the origin scheme, hostname, and port match the external site exactly.
*   Ensure that you exclude trailing slashes or paths.
*   Ensure that other security policies on the external site do not block the connection.

Configuring permitted origins
-----------------------------

To enable external websites to embed your pages, add their origins to the permitted list. Source CMS always permits your own site to embed its own pages. 

To configure permitted origins:

1.  [Access your site](https://docs.acquia.com/node/69836#access-a-site).
2.  In the left sidebar, click **Configuration**.
3.  From the **Configuration** menu, select **System**.
4.  Select **Iframe embedding**. 
5.  In the **Allowed embedding origins** text area, enter one origin per line.
6.  Include the scheme for each origin. 
    *   Each origin must include the scheme `(https://)`. For example, `https://www.example.com`.
    *   To enable subdomain wildcards, use the `*.` prefix. For example, `https://*.example.com`.  
    *   To enable only your own site, leave the text area empty. Do not add your own site to the list.
        
        To review all formatting requirements, refer to the ****Validation rules**** section.
        
7.  Click **Save configuration**.
    
    Note
    
    If previously saved origins disappear at a later time, another administrator directly modified the Security Kit settings and the system overwrote your origins. To resolve this issue, ensure that you have the Administrator role and re-enter the origins in the form. 
    

Removing an origin
------------------

To revoke embedding permission for a previously permitted origin:

1.  [Access your site](https://docs.acquia.com/node/69836#access-a-site).
2.  In the left sidebar, click **Configuration**.
3.  From the **Configuration** menu, select **System**.
4.  Select **Iframe embedding**. 
5.  In the **Allowed embedding origins text area**, delete the lines or lines for the origins.
6.  Click **Save configuration**.