H5P iframe embed fix for external sites

We migrated to a new Domain of One’s Own server on Tuesday. I’ve been hunting down various things since. Here is one.

We have a dedicated H5P WordPress multisite. iframe embeds of the H5P content were failing because of some new security settings on our new server were required same origin for iframes. You could see that in the console log or just see that the embeds failed to load entirely.

Adding the following to the .htaccess file at the public_html directory for that site fixed things. If you’re going through cPanel’s file browser, make sure you turn on “see invisible files” in your preferences or the . files will forever elude you.

The following should keep the good stuff about the iframe security while allowing the H5P stuff to still work.

# H5P iframe embed fix 
<IfModule mod_headers.c>
    <If "%{QUERY_STRING} =~ /action=h5p_embed/">
        Header unset X-Frame-Options
        Header always unset X-Frame-Options
    </If>
</IfModule>