Header set Content-Security-Policy "frame-ancestors *" Header unset X-Frame-Options