Security plugins and headers

AjaxPress shows each page inside a frame on your own site. Security settings that forbid your pages from appearing in any frame, even your own, leave AjaxPress with a blank page. Everything else in security plugins works as usual.

The one header that matters

Browsers decide whether a page may be framed from two response headers. Check yours, and make sure they allow your own site:

Header	Blocks AjaxPress	Works with AjaxPress
X-Frame-Options	DENY	SAMEORIGIN, or no header
Content-Security-Policy	frame-ancestors 'none'	frame-ancestors 'self', or no frame-ancestors

Both working options still stop other websites from framing yours, which is what these headers are for. So switching from DENY to SAMEORIGIN keeps you protected against clickjacking.

If your policy has a frame-src or child-src rule, it must include 'self' too.

How to check your headers

1. Open your site, then the browser’s developer tools (F12).
2. Go to Network, reload, and click the first request (your page).
3. Under Response Headers, look for x-frame-options and content-security-policy.

Or run this in a terminal:

curl -sI https://example.com/ | grep -iE 'x-frame-options|content-security-policy'

Where these headers come from

• Security plugins with a “security headers” or “clickjacking protection” option, such as Really Simple Security, Solid Security, All-In-One Security, and dedicated header plugins. Set frame options to SAMEORIGIN.
• Your host, in its control panel’s security or header settings.
• Your server configuration: an .htaccess file on Apache or LiteSpeed, or the site’s Nginx configuration.
• Cloudflare: a Transform Rule or a Worker that adds response headers.

Other security features

Feature	With AjaxPress
Firewall and malware scanning	No effect
Two-factor login, login CAPTCHA	Works. If signing in misbehaves, turn on Full Page Reload on Login & Registration
Custom login URL (hiding wp-login.php)	Works
Rate limiting of page views	Each page change is one page request, as without AjaxPress. With prefetch on, hovering adds a few more, so very strict limits may need raising
Blocking bots or countries	No effect on real visitors

Symptoms

A header that blocks framing shows up as a white or empty page after clicking a link, or right when the first page loads, often with this in the browser console:

Refused to display 'https://example.com/' in a frame because it set 'X-Frame-Options' to 'deny'.

See A page is blank or the loader never finishes.