# ERROR: Blocked by X-Frame-Options Policy **URL:** \ **Category:** Developer help\ **Created:** [May 13, 2020, 9:11am UTC](https://forum.ghost.org/t/error-blocked-by-x-frame-options-policy/14300 "2020-05-13T09:11:55Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![akash47](https://avatars.discourse-cdn.com/v4/letter/a/ecc23a/32.png) [@akash47](https://forum.ghost.org/u/akash47)\ **Post date:** [May 13, 2020, 9:11am UTC](https://forum.ghost.org/t/error-blocked-by-x-frame-options-policy/14300/1 "2020-05-13T09:11:55Z")
Hi everyone, I’m getting the below error: ![xframe](https://us1.discourse-cdn.com/flex015/uploads/ghost2/original/2X/d/d1c9f3daf1d7e9818b3298d60c9b81ec4c181065.png) The reason is because I’m running a reverse proxy (using Cloudflare workers) to proxy all traffic **from** : `blog.wowclub.com/*` **to** : `wowclub.com/blog/*` And it works well for the most part. It is fully usable. But these are the other things that aren’t working: 1. Search 2. Appending a /edit to the end of a blog post to edit it I think it has something to do with the content API ![auth_fail](https://us1.discourse-cdn.com/flex015/uploads/ghost2/original/2X/5/512da1b7ef6a4d462a9eddb1397a57d1cb1f1e41.png) Would really appreciate some help to point me in the right direction. Thank you! ---
**Author:** ![akash47](https://avatars.discourse-cdn.com/v4/letter/a/ecc23a/32.png) [@akash47](https://forum.ghost.org/u/akash47)\ **Post date:** [May 14, 2020, 9:36am UTC](https://forum.ghost.org/t/error-blocked-by-x-frame-options-policy/14300/2 "2020-05-14T09:36:53Z")
@vikaspotluri123 Would you know? I read your reply [here](https://forum.ghost.org/t/ghost-seems-to-violate-my-csp-policy/14227), and I’m not sure if I need to change anything in my Nginx configuration. After all, I have set up cloudflare to do all the re-directing. thanks! ---
**Author:** ![vikaspotluri123](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/vikaspotluri123/32/24_2.png) [@vikaspotluri123](https://forum.ghost.org/u/vikaspotluri123)\ **Post date:** [May 14, 2020, 8:37pm UTC](https://forum.ghost.org/t/error-blocked-by-x-frame-options-policy/14300/3 "2020-05-14T20:37:20Z")
If you’re running the admin panel on a different domain, try setting the admin url (search for admin on this page): [https://ghost.org/faq/change-configured-site-url/](https://ghost.org/faq/change-configured-site-url/) ---
**Author:** ![akash47](https://avatars.discourse-cdn.com/v4/letter/a/ecc23a/32.png) [@akash47](https://forum.ghost.org/u/akash47)\ **Post date:** [May 15, 2020, 4:57pm UTC](https://forum.ghost.org/t/error-blocked-by-x-frame-options-policy/14300/4 "2020-05-15T16:57:59Z")
Hi @vikaspotluri123, I suppose that does apply to me. I’m technically running the admin panel on [Ghost Admin](http://blog.wowclub.com/blog/ghost/) So I ran the command `ghost config admin.url https:// blog.wowclub.com/blog` But, unfortunately I’m now in a 502 error that I can’t resolve. `502 Bad Gateway` `nginx/1.10.3 (Ubuntu)` I’ve tried to re-setup nginx, restart ghost - to no avail. `ghost log -f` shows that ghost is running fine on production & no error. Bit stumped. Anything I could try? Is there a way to revert my changes? ---
**Author:** ![vikaspotluri123](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/vikaspotluri123/32/24_2.png) [@vikaspotluri123](https://forum.ghost.org/u/vikaspotluri123)\ **Post date:** [May 15, 2020, 6:22pm UTC](https://forum.ghost.org/t/error-blocked-by-x-frame-options-policy/14300/5 "2020-05-15T18:22:16Z")
I don’t think it’s possible to remove a config key. You’ll have to manually edit the config file and remove the ```auto , "admin": { "url": "" } ``` section The bad gateway error makes me think something is messed up in the DNS / IP level in terms of how you configured your domain / proxy ---
**Author:** ![akash47](https://avatars.discourse-cdn.com/v4/letter/a/ecc23a/32.png) [@akash47](https://forum.ghost.org/u/akash47)\ **Post date:** [May 16, 2020, 4:23am UTC](https://forum.ghost.org/t/error-blocked-by-x-frame-options-policy/14300/6 "2020-05-16T04:23:34Z")
As soon as I removed that config key, it started to work again 🙂 Thanks! Though, I’m still where i was w.r.t to the original problem - but at least things are back up and running! ---
**Author:** ![vikaspotluri123](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/vikaspotluri123/32/24_2.png) [@vikaspotluri123](https://forum.ghost.org/u/vikaspotluri123)\ **Post date:** [May 16, 2020, 5:22pm UTC](https://forum.ghost.org/t/error-blocked-by-x-frame-options-policy/14300/7 "2020-05-16T17:22:44Z")
did you add any custom headers to the blog response? ---
**Author:** ![akash47](https://avatars.discourse-cdn.com/v4/letter/a/ecc23a/32.png) [@akash47](https://forum.ghost.org/u/akash47)\ **Post date:** [May 19, 2020, 8:34am UTC](https://forum.ghost.org/t/error-blocked-by-x-frame-options-policy/14300/8 "2020-05-19T08:34:11Z")
I haven’t added any custom headers. But, we do use Cloudflare workers to proxy traffic - so I don’t know if that is adding something to the response. ---
**Author:** ![vikaspotluri123](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/vikaspotluri123/32/24_2.png) [@vikaspotluri123](https://forum.ghost.org/u/vikaspotluri123)\ **Post date:** [May 19, 2020, 3:45pm UTC](https://forum.ghost.org/t/error-blocked-by-x-frame-options-policy/14300/9 "2020-05-19T15:45:26Z")
I have a feeling this might be a limitation of the default nginx configuration. If you set up SSL, it adds this line by default: > The workaround is to comment that line out, or add logic to send the allow header if you’re on the Admin origin ---
**Author:** ![akash47](https://avatars.discourse-cdn.com/v4/letter/a/ecc23a/32.png) [@akash47](https://forum.ghost.org/u/akash47)\ **Post date:** [May 22, 2020, 8:19am UTC](https://forum.ghost.org/t/error-blocked-by-x-frame-options-policy/14300/10 "2020-05-22T08:19:31Z")
Thanks! I’ll check that out, but when I’ve I understand nginx better. I’m bit worried I’ll break things again 🙂 ---
**Author:** ![themeix](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/themeix/32/4472_2.png) [@themeix](https://forum.ghost.org/u/themeix)\ **Post date:** [October 20, 2022, 6:03am UTC](https://forum.ghost.org/t/error-blocked-by-x-frame-options-policy/14300/11 "2022-10-20T06:03:05Z")
```auto add_header X-Frame-Options "allow-from https://newwebsiteurl.com/"; ``` Sometime we may need to give x-frame access to a specific domain… above code may help for that.