{"id":21836,"date":"2026-11-06T10:15:03","date_gmt":"2026-11-06T07:15:03","guid":{"rendered":"https:\/\/sunucun.com.tr\/blog\/fix-err-blocked-by-response\/"},"modified":"2026-11-06T10:15:03","modified_gmt":"2026-11-06T07:15:03","slug":"fix-err-blocked-by-response","status":"publish","type":"post","link":"https:\/\/sunucun.com.tr\/blog\/fix-err-blocked-by-response\/","title":{"rendered":"What Is ERR_BLOCKED_BY_RESPONSE and How Do You Fix It?"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 ez-toc-wrap-center counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<span class=\"ez-toc-title-toggle\"><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/sunucun.com.tr\/blog\/fix-err-blocked-by-response\/#What_Does_ERR_BLOCKED_BY_RESPONSE_Mean\" >What Does ERR_BLOCKED_BY_RESPONSE Mean?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/sunucun.com.tr\/blog\/fix-err-blocked-by-response\/#Causes_of_the_Error\" >Causes of the Error<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/sunucun.com.tr\/blog\/fix-err-blocked-by-response\/#What_You_Can_Do_as_a_Visitor\" >What You Can Do as a Visitor<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/sunucun.com.tr\/blog\/fix-err-blocked-by-response\/#How_to_Fix_It_as_a_Site_Owner_or_Developer\" >How to Fix It as a Site Owner or Developer<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/sunucun.com.tr\/blog\/fix-err-blocked-by-response\/#1_Find_Which_Header_Is_Blocking\" >1. Find Which Header Is Blocking<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/sunucun.com.tr\/blog\/fix-err-blocked-by-response\/#2_Allow_Framing_Only_for_Sites_You_Trust\" >2. Allow Framing Only for Sites You Trust<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/sunucun.com.tr\/blog\/fix-err-blocked-by-response\/#3_Fix_the_CORP_Setting_for_Shared_Resources\" >3. Fix the CORP Setting for Shared Resources<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/sunucun.com.tr\/blog\/fix-err-blocked-by-response\/#4_If_You_Cannot_Frame_Another_Sites_Page\" >4. If You Cannot Frame Another Site&#8217;s Page<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/sunucun.com.tr\/blog\/fix-err-blocked-by-response\/#Conclusion\" >Conclusion<\/a><\/li><\/ul><\/nav><\/div>\n\n<p class=\"wp-block-paragraph\"><strong>ERR_BLOCKED_BY_RESPONSE<\/strong> is an error showing that the browser blocked a page or resource because the <strong>response headers<\/strong> sent by the server do not allow it. It most often appears when a site is embedded in another site with an <code>iframe<\/code>: the frame shows &#8220;\u2026 refused to connect&#8221; and the console shows <code>net::ERR_BLOCKED_BY_RESPONSE<\/code>. In this guide we explain the causes and the fixes for site owners and developers.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_Does_ERR_BLOCKED_BY_RESPONSE_Mean\"><\/span>What Does ERR_BLOCKED_BY_RESPONSE Mean?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n<p class=\"wp-block-paragraph\">This error is not a connection problem: the request reached the server and a response came back. But a security header in the response forbids the content from being shown in this context (for example inside another site&#8217;s frame), and the browser follows that rule. In other words, the browser is enforcing the site&#8217;s own security rule. In the console the error sometimes appears with an extra explanation, such as <code>ERR_BLOCKED_BY_RESPONSE.NotSameOrigin<\/code>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Causes_of_the_Error\"><\/span>Causes of the Error<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n<ul class=\"wp-block-list\"><li><strong>X-Frame-Options:<\/strong> If a page sends <code>X-Frame-Options: DENY<\/code> or <code>SAMEORIGIN<\/code>, it will not open inside other sites&#8217; frames.<\/li><li><strong>CSP frame-ancestors:<\/strong> The <code>frame-ancestors<\/code> directive in the <code>Content-Security-Policy<\/code> header sets which sites may frame the page.<\/li><li><strong>Cross-Origin-Resource-Policy (CORP):<\/strong> If an image, script or file is served with a <code>same-origin<\/code> or <code>same-site<\/code> policy, it cannot be loaded from other sites.<\/li><li><strong>Cross-Origin-Embedder-Policy (COEP):<\/strong> If your page uses a <code>require-corp<\/code> policy, external resources that do not send a permission header are blocked.<\/li><li><strong>Security plugin or CDN rule:<\/strong> WordPress security plugins and CDN settings can add these headers automatically.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_You_Can_Do_as_a_Visitor\"><\/span>What You Can Do as a Visitor<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n<p class=\"wp-block-paragraph\">Because the rule is set by the site itself, there is no permanent fix on the visitor&#8217;s side. If you want to see the content inside the frame, open the link directly in a new tab; the page loads normally. Browser extensions that strip these headers are not recommended, because the headers protect you against attacks such as clickjacking.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_to_Fix_It_as_a_Site_Owner_or_Developer\"><\/span>How to Fix It as a Site Owner or Developer<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"1_Find_Which_Header_Is_Blocking\"><\/span>1. Find Which Header Is Blocking<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n<p class=\"wp-block-paragraph\">In the <strong>Network<\/strong> tab of the developer tools, click the blocked request and look at the <strong>Response Headers<\/strong>. You can also check from the command line:<\/p>\n\n\n<pre class=\"wp-block-code\"><code>curl -sI https:\/\/yourdomain.com\/page | grep -iE \"x-frame-options|content-security-policy|cross-origin\"<\/code><\/pre>\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"2_Allow_Framing_Only_for_Sites_You_Trust\"><\/span>2. Allow Framing Only for Sites You Trust<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n<p class=\"wp-block-paragraph\">If you want your own page to open inside a frame on a specific site, use CSP instead of <code>X-Frame-Options<\/code> and list the allowed sites explicitly. An example for Nginx:<\/p>\n\n\n<pre class=\"wp-block-code\"><code>add_header Content-Security-Policy \"frame-ancestors 'self' https:\/\/allowed-site.com\" always;<\/code><\/pre>\n\n\n<p class=\"wp-block-paragraph\">If the same response also sends <code>X-Frame-Options: DENY<\/code>, remove it. Allowing every site to frame the page (<code>frame-ancestors *<\/code>) increases the clickjacking risk; add only the sites that really need it.<\/p>\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"3_Fix_the_CORP_Setting_for_Shared_Resources\"><\/span>3. Fix the CORP Setting for Shared Resources<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n<p class=\"wp-block-paragraph\">If your images or files need to be used on other sites, serve them with the <code>Cross-Origin-Resource-Policy: cross-origin<\/code> header. If your page uses COEP, the external resources you load must send this header or be loaded with CORS.<\/p>\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"4_If_You_Cannot_Frame_Another_Sites_Page\"><\/span>4. If You Cannot Frame Another Site&#8217;s Page<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n<p class=\"wp-block-paragraph\">If the header comes from another site&#8217;s server, you cannot change it. In that case, use the site&#8217;s official embed link or API, or link to the content instead.<\/p>\n\n\n<p class=\"wp-block-paragraph\">If the console shows a generic CORS-related error, see our guide on <a href=\"https:\/\/sunucun.com.tr\/blog\/fix-err-failed\/\">ERR_FAILED<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Conclusion\"><\/span>Conclusion<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n<p class=\"wp-block-paragraph\">ERR_BLOCKED_BY_RESPONSE shows that the browser blocked a page or resource by following the site&#8217;s own security headers. As a visitor, opening the page in a new tab is enough. If you own the site, set the X-Frame-Options, CSP frame-ancestors and Cross-Origin-Resource-Policy headers to match your needs, allowing only sites you trust.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>ERR_BLOCKED_BY_RESPONSE is an error showing that the browser blocked a page or resource because the response headers sent by the server do not allow it. It most often appears when a site is embedded in another site with an iframe: the frame shows &#8220;\u2026 refused to connect&#8221; and the console shows net::ERR_BLOCKED_BY_RESPONSE. In this guide&hellip;<\/p>\n","protected":false},"author":1,"featured_media":21842,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[1521],"tags":[],"class_list":["post-21836","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-teknoloji"],"_links":{"self":[{"href":"https:\/\/sunucun.com.tr\/blog\/wp-json\/wp\/v2\/posts\/21836","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sunucun.com.tr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sunucun.com.tr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sunucun.com.tr\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sunucun.com.tr\/blog\/wp-json\/wp\/v2\/comments?post=21836"}],"version-history":[{"count":0,"href":"https:\/\/sunucun.com.tr\/blog\/wp-json\/wp\/v2\/posts\/21836\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sunucun.com.tr\/blog\/wp-json\/wp\/v2\/media\/21842"}],"wp:attachment":[{"href":"https:\/\/sunucun.com.tr\/blog\/wp-json\/wp\/v2\/media?parent=21836"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sunucun.com.tr\/blog\/wp-json\/wp\/v2\/categories?post=21836"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sunucun.com.tr\/blog\/wp-json\/wp\/v2\/tags?post=21836"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}