I have www.example.com a WordPress website and www.official.com this third-party website, I want to invoke <iframe src="www.example.com"></iframe> in www.official.com

Here my website is running but cookies blocking

How to achieve it?

My website: https://wp-developer.online/ ( Woocommerce WordPress Website )

Here is another domain or localhost server ( Cookies blocking Image Proof)

enter image description here

I need to run this website https://wp-developer.online/ as iframe in different domain , please resolve me this , its important project for me


1 Answer 1


Most modern browsers no longer follow the old cookie spec (where cookies were automatically sent no matter where the request came from), and now follow the new SameSite spec, where cookies by default are only sent when the top-level domain is the same as the site ("site" is more inclusive than "origin", but for two different domains such as you're talking about, they would be considered different sites) that the request is going to. This means that the cookies for your own site won't get sent if your site is in an iframe on a third-party site. Specifically, cookies these days default to acting as though set with samesite="lax" unless a different value for samesite is specified. You must (on most browsers) explicitly set the samesite="none" flag on your cookies to allow them to be sent when their page is framed on a different site. Note that (on many browsers) this only works in HTTPS (secure) contexts. Exact details for how to set this flag for your web app framework are out of scope for this site; search on StackOverflow or similar if you can't figure it out.

Be aware that even with samesite="none", some browsers may block cookies on requests originating from cross-domain iframes, as "third-party" cookies. Apple Safari (and all browsers on iOS, which are essentially wrappers around Safari) in particular has a feature where, if your site has not previously been visited as a top-level site and set a cookie for itself, then it won't be allowed to set cookies through any other sites (e.g. when in an iframe) and therefore won't have cookies at all. If your iframed site needs cookies to work, you MUST make sure the user has visited the site as the top-level site (the address in the URL bar) and received one or more cookies at that time. One way to do this is, if your site detects that it doesn't have cookies, present the user with a link to navigate the entire tab (or open a new tab) to your site.

  • Thanks, @CBHacking, its true that we need to set manually SameSite=None and Secure, I fixed it for cart cookies, and now I am able to put products on the cart, but I couldn't able login while I am in an iframe, is there any way to setcookies on wp login.php ? Feb 13, 2023 at 18:02
  • Logging in inside an iframe is a bad idea to start with, because you're asking users to send credentials for your site to a third-party site (the user has no way to tell the difference between an iframe of your login page, and a phishing page mocked up to look like your login page, so the advice is to only enter credentials for a given site X if the navigation bar at the top says you're on site X). With that said, "how do I do <something> in Wordpress?" is off-topic for Security.SE.
    – CBHacking
    Feb 13, 2023 at 19:18
  • no its for testing purpose we are doing , i need to login website while in iframe , wp login cookie need to set SameSite=None , i am finding the way to set this cookie , if possible please help me on this sir , thank you @CBHacking Feb 14, 2023 at 9:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .