Embedding EOL (Iframes have 'X-Frame-Options' set to 'SAMEORIGIN')

Hiya - it’s a while since I’ve hung around the EoL site. As I’m sure you know, I’m involved in the OneZoom project, and we have previously been embedding EoL pages on our site, so that users can access biodiversity information from EoL. However, embedding Iframes is now not possible because of an updated “X-Frame-Options” setting on the EoL site. Is this intentional, and if not, can it be reversed?



Stand by, @YanWong ! Jeremy thinks that was a change in default settings that we probably inherited from a routine update somewhere in the software millefeuille. He’s tracking it down.

Thanks for reporting!


@YanWong , could you try poking beta.eol.org and let me know if it’s set up correctly?

…Yeah, we just updated/changed a lot of the backend tech (varnish, nginx, switched from unicorn to puma) and this feature got plastered in the process, apologies! Thanks for bringing it to our attention.

Hi Jeremy! The setup on beta.eol.org does seem to work fine, thanks (although the beta.eol.org site seems quite slow to load new pages: some sort of caching thing I guess).

Thanks again for sorting, and hope all’s well with folk at EoL.


Yes, our beta setup is rather underpowered compared to the main site, though, TBH, there’s a long way to go with the main site, too. We’re working diligently on improving it, though! …juuuuuuust… breaking a few things as we head that way. :S

I’ll be updating production with this code shortly, you should be back in business in 30 minutes or so.

Thanks so much, Jeremy

However, I am getting a " Error 503 Backend fetch failed" on all pages now, e.g.


Indeed, the whole site is down right now. …When I pushed these changes (coincidentally), we encountered a MASSIVE configuration problem. Clearly unrelated, but I haven’t yet been able to solve the problem. Yeesh. :expressionless:

I hope the site will be up soon, but I’ve been at this for hours and I’m getting nowhere. :expressionless:

Sorry for the delay!

@YanWong - The site should be back up, and it SHOULD be using the new code with the correct X-Frame-Options. Let me know if it worked.

(The site will be down briefly again later today for some additional changes, but it should be less than a minute. SHOULD be.)

1 Like

That works fine now. The X-Frame-Options are set as I had hoped. Sympathies for the config problem; I’m glad it seems to be sorted now.