I have a website where I am blocking it from being loaded via iframe into other websites.

What I want is to keep this in place, but allow certain URLs from my website, to be iframed anywhere.

For example, allowing these to be iframed:

And everything that lives under that, for example:


From what I am reading, it seems like I need to add ALLOW-FROM ? Or is that only to specify the domains that have access?

Is there an option to configure it the way I've described?

This is the header as it stands now:

  "rules": [
      "name": "Adding X-Permitted-Cross-Domain-Policies",
      "continue": true,
      "match": [
          "field": "all"
      "actions": [
          "action": "set-header",
          "header": "X-Permitted-Cross-Domain-Policies",
          "value": "master-only"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.