# Iframe and php\_include **URL:** \ **Category:** General PHP Help\ **Created:** [November 8, 2020, 9:15pm UTC](https://www.phphelp.com/t/iframe-and-php-include/32777 "2020-11-08T21:15:43Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Sluwe](https://www.phphelp.com/letter_avatar_proxy/v4/letter/s/51bf81/32.png) [@Sluwe](https://www.phphelp.com/u/Sluwe)\ **Post date:** [November 8, 2020, 9:15pm UTC](https://www.phphelp.com/t/iframe-and-php-include/32777/1 "2020-11-08T21:15:43Z")
Hello, I am new here, and hopefully i get some answers and can fix this issue. I have an iframe with \ so the iframe cant be used on other domains. I have made an test to see the deny function is working… [http://www.footy.to/iframe.php](http://www.footy.to/iframe.php) , the iframe is at other domain and cant be use due the deny function, but now i am curious how to stop this when people using this technic \ They are bypassing the deny option and the iframe is visible here [http://www.footy.to/14.php](http://www.footy.to/14.php) how can i stop them to include stuff from my site or bypass the deny option. Any help will be appreciated. Thanks In advance ---
**Author:** ![skawid](https://www.phphelp.com/letter_avatar_proxy/v4/letter/s/bbe5ce/32.png) [@skawid](https://www.phphelp.com/u/skawid)\ **Post date:** [November 9, 2020, 11:27am UTC](https://www.phphelp.com/t/iframe-and-php-include/32777/2 "2020-11-09T11:27:57Z")
There’s no guaranteed way to do this; the content of your iframe is public on the internet. [X-Frame-Options](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options) is used for security rather than to control access to content. Is this page supposed to be behind a login, or do you just not want other people iframing your content? ---
**Author:** ![benanamen](https://www.phphelp.com/user_avatar/www.phphelp.com/benanamen/32/287_2.png) [@benanamen](https://www.phphelp.com/u/benanamen)\ **Post date:** [November 9, 2020, 4:10pm UTC](https://www.phphelp.com/t/iframe-and-php-include/32777/3 "2020-11-09T16:10:40Z")
X frames is a server setting not a code setting. You have it in the wrong place. Optimally you need to put it in the server config file. If you do not have access to that then it goes in htaccess. ---
**Author:** ![Sluwe](https://www.phphelp.com/letter_avatar_proxy/v4/letter/s/51bf81/32.png) [@Sluwe](https://www.phphelp.com/u/Sluwe)\ **Post date:** [November 9, 2020, 4:33pm UTC](https://www.phphelp.com/t/iframe-and-php-include/32777/4 "2020-11-09T16:33:32Z")
Hello , Thanks for reply, I just dont want others use the content, for what i am doing on my site he will consume alot bandwith where i pay for 😉 ---
**Author:** ![Sluwe](https://www.phphelp.com/letter_avatar_proxy/v4/letter/s/51bf81/32.png) [@Sluwe](https://www.phphelp.com/u/Sluwe)\ **Post date:** [November 9, 2020, 4:35pm UTC](https://www.phphelp.com/t/iframe-and-php-include/32777/5 "2020-11-09T16:35:57Z")
Hello, I tried this into .htaccess, but it seems lightspeed work different then apache. I can block using my scripts, but then i block my own domain too. I need to ask host if i have access to lightspeed settings ---
**Author:** ![skawid](https://www.phphelp.com/letter_avatar_proxy/v4/letter/s/bbe5ce/32.png) [@skawid](https://www.phphelp.com/u/skawid)\ **Post date:** [November 10, 2020, 9:41am UTC](https://www.phphelp.com/t/iframe-and-php-include/32777/6 "2020-11-10T09:41:29Z")
There’s a couple of things you can do to make it harder for other sites to load your content. As I said before these aren’t 100% effective, but it will stop any casual attempts: 1. In your iframed code, check `$_SERVER['HTTP_REFERER']` and `$_SERVER['HTTP_USER_AGENT']`. `HTTP_REFERER` will be the URL of your main page for iframe requests, and `HTTP_USER_AGENT` should only exist if the request came from a browser. It is possible to spoof these values though. 2. Protect your iframe by requiring a token that only your main page knows. Alter your main page to open the iframe as `http://www.footy.to/iframe.php?secret=[some token]`. `[some token]` should be a random string that you generate for every request to your main page, and store in your back end. Your iframe can then check that `[some token]` is correct, and refuse to render if it isn’t. It’s possible to spoof this as well. ---
**Author:** ![Sluwe](https://www.phphelp.com/letter_avatar_proxy/v4/letter/s/51bf81/32.png) [@Sluwe](https://www.phphelp.com/u/Sluwe)\ **Post date:** [November 10, 2020, 8:55pm UTC](https://www.phphelp.com/t/iframe-and-php-include/32777/7 "2020-11-10T20:55:11Z")
Hey, I will try this solution. Thanks for answer!!