Disable "X-Frame-Options: SAMEORIGIN" http response header for one page

Developer Support CMS Development
1

I have a requirement to host a simple (static?) maintenance page for a Microsoft Power Pages site… the details are here:

…seems simple but they Power Pages site will load the maintenance page in an iFrame and so requires “X-Frame-Options:SAMEORIGIN” to not be present. By default HubSpot sets an http response header “X-Frame-Options:SAMEORIGIN” when serving all pages.

  1. Can an individual HubSpot page be configured to be served without this http header?
  2. If not, is it perfectly acceptable to add a static html page to HubSpot Files and serve the page from there?
2

Hi @jamietetlow

As far as I know, you should not be getting the header “X-Frame-Options:SAMEORIGIN” by default - that is something you would turn on in your domain security settings in order to show up.

However, this setting applies at the domain level, so it cannot be controlled for individual pages.

So you could either turn it off for your domain or, if you need that to be on, you could connect a sub-domain to HubSpot and publish the maintenance page on that sub-domain with the X-Frame-Options header turned off.

Hope this helps!