Hi tippet,

X-Frame-Options header used to control whether a page can be placed in an IFRAME.

There are three possible directives for X-Frame-Options:

• deny:

Not only will attempts to load the page in a frame fail when loaded from other sites, but attempts to do so will also fail when loaded from the same site.

• sameorigin:

 You can still use the page in a frame as long as the site including it in a frame is the same as the one serving the page.

• allow-from uri:

The page can only be displayed in a frame on the specified origin. Note that in Firefox this still suffers from the same problem as sameorigin did — it doesn't check the frame ancestors to see if they are in the same origin.

<httpProtocol>
<customHeaders>
<add name="X-Frame-Options" value="ALLOW-FROM http://www.sample2.com" />
</customHeaders>
</httpProtocol>

Browser compatibility:

You could also refer below article:

• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
• https://support.managed.com/kb/a2664/allow-iframe-fix-issue-display-forbidden-by-x-frame-options.aspx
• https://stackoverflow.com/questions/25316781/x-frame-options-not-working-iis-web-config
• https://blogs.msdn.microsoft.com/ieinternals/2010/03/30/combating-clickjacking-with-x-frame-options/