Iframe Refused to Connect

I'm having an issue when embedding an iframe virtual tour to our squarespace site. We keep getting the message "refused to connect".

After some reading, we assumed that our https url was somehow converting to http when embedded, so we added a rewriterule to our .htaccess file so http cannot be substituted, but we are still getting the error. The odd thing is we embedded a .jpg image from the same server and it displays fine.. Anyone have any ideas?

Squarespace embedded page:

http://www.tanner-designed.com/shay-residence

A2 embedded URL

https://www.tanner-storage.com/shaytour10/index.htm

Same here.

Having the same issue. I'm building a portfolio site to show off the Squarespace sites I've created. Sites on 7.0 show up in an the iFrame without issue. 7.1 sites (for example, https://www.tonihaberteam.com/) don't show up. The iframe on the portfolio site says "www.tonihaberteam.com refused to connect." 

I tried changing the DNS and Name servers to match a working 7.0 site but it didn't work. Any ideas?

2 hours ago, JackNathanRichards said:

7.1 sites (for example, https://www.tonihaberteam.com/) don't show up. The iframe on the portfolio site says "www.tonihaberteam.com refused to connect." 

SS has set a policy to not allow their sites to be loaded via iframes unless the src is from the same domain.

Quote

Sites on 7.0 show up in an the iFrame without issue.

This is because SS has not set the X-frame-Options to sameorigin for v7.0 sites.

On 12/6/2022 at 3:20 AM, creedon said:

SS has set a policy to not allow their sites to be loaded via iframes unless the src is from the same domain.

Thanks for the quick reply. Since I have access to the 7.1 site I'm trying to iFrame, do you know if there is a code I can inject to change the X-Frame-Options to allow from my portfolio site? Everything I'm seeing online seems like a no since it's a server setting, but maybe there's a workaround I'm missing.

2 minutes ago, JackNathanRichards said:

Everything I'm seeing online seems like a no since it's a server setting

SS does not allow access to their backend.